DNS Query Tor .Onion Address - Sysmon (b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544)

Detects DNS queries to an ".onion" address related to Tor routing networks

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
DNS Query Tor .Onion Address - Sysmon (b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544)	Sigma-Rules	Multi-hop Proxy - T1090.003 (a782ebe2-daba-42c7-bc82-e8e9d923162d)	Attack Pattern	1
Multi-hop Proxy - T1090.003 (a782ebe2-daba-42c7-bc82-e8e9d923162d)	Attack Pattern	Proxy - T1090 (731f4f55-b6d0-41d1-a7a9-072a66389aea)	Attack Pattern	2