DETECTION OVERVIEW
Risk Factors
Outbound Tor-based traffic can indicate anonymous internet browsing, or anonymous access to dark nets. This traffic could also indicate that a compromised or unauthorized device is communicating with an attacker-controlled server through the Tor network. To carry out these activities, a user must have expertise and familiarity with Tor. While these activities are uncommon, they should be examined before they enable critical and costly attacks.
Kill Chain
Risk Score
84
N/A
Quarantine the device associated with outbound Tor traffic while checking for indicators of compromise