Tega Ewubare

Threat Hunt Report: Unauthorized TOR Usage

Platforms and Technology Used

Scenario

Management suspects that some employees may be using TOR browsers to bypass network security controls because recent network logs show unusual encrypted traffic patterns and connections to known TOR entry nodes. Additionally, there have been anonymous reports of employees discussing ways to access restricted sites during work hours. The goal is to detect any TOR usage and analyze related security incidents to mitigate potential risks. If any use of TOR is found, notify management.

Steps Taken

1. Searched the DeviceFileEvents Table

The DeviceFileEvents table was searched for any file containing the string "tor" to identify installation artefacts and related files. This initial query successfully detected the incident beginning at 3:44:45 PM on July 5, 2025, revealing Tor browser components and a suspicious file named "tor-shopping-list.txt" on device "thl-machine".

Query used:


DeviceFileEvents
| where FileName contains "tor"
| project Timestamp, DeviceName, FileName, ActionType
image

2. Searched the DeviceProcessEvents Table

The DeviceProcessEvents table was then searched to identify if the Tor program had been installed. This then revealed evidence of a deliberate stealth installation of Tor using a silent installation command.

Query used:


DeviceProcessEvents
| where ProcessCommandLine contains "tor-browser-windows-x86_64-portable-14.5.4.exe"
| project Timestamp, DeviceName, FileName, ActionType, ProcessCommandLine, SHA256
image ---

3. Searched the DeviceProcessEvents Table for TOR Browser Execution

A search of DeviceProcessEvents was conducted to confirm active execution of the core Tor program after it was installed.

Query used to locate events:


DeviceProcessEvents  
| where FileName == "tor.exe"
| project Timestamp, DeviceName, FileName, ActionType, ProcessCommandLine, SHA256
image ---

4. Searched the DeviceNetworkEvents Table for TOR Network Connections

Finally the DeviceNetworkEvents table was analyzed to detect Tor network connections from known Tor ports and confirm operational usage. Successful Tor network establishment was confirmed at 3:48:49 PM, with connections to the entry node 165.49.20.10:9001 and local proxy usage on 127.0.0.1:9150, indicating Tor was actively browsed on the network.

Query used:


DeviceNetworkEvents
| where RemotePort in ("9001","9030","9040","9050","9051","9150")
| project Timestamp,DeviceName,ActionType,RemoteIP,RemotePort,RemoteUrl,InitiatingProcessFileName
image ---

Chronological Event Timeline

1. File Activity - File Rename

2. Process Execution - TOR Browser Installer Launch

3. File Deletion - Installer Cleanup

4. Process Execution - Silent Installation

5. File Creation - TOR License Files

6. File Creation - TOR Executable

7. Network Connection - TOR Entry Node

8. File Creation - Web Application Storage

9. Connection Failure - Firefox to TOR Proxy

10. File Creation - Form History Database

11. File Creation - Suspicious Document

Summary

An unauthorized TOR browser installation and usage incident was identified on workstation "thl-machine" on July 5, 2025. The user performed a stealth installation and successfully established TOR network connections. There was also the creation of a file that indicated that the employee might have intened to shop using the Tor browser. The activity demonstrates a clear intent to bypass corporate security restrictions and may pose significant operational and data security risks.

Response Taken

TOR usage was confirmed on the endpoint thl-machine by the user subcontractor. The device was isolated, and the user's direct manager was notified.