Connections to Tor Exit Nodes

Detects network connections to or from known Tor exit nodes by matching endpoint telemetry against a curated lookup file of Tor exit node IPs.

CQL · Falcon Next-Gen SIEMCopy query

#event_simpleName=NetworkConnectIP4
| match(file="tor-exit-nodes.csv", field=RemoteAddressIP4, column=ip, strict=true)
| groupBy(
    [aid, ComputerName],
    function=[
        count(aid, as=ConnectionCount),
        count(aid, distinct=true, as=UniqueIPs),
        collect([RemoteAddressIP4, RemotePort]),
        min(@timestamp, as=FirstSeen),
        max(@timestamp, as=LastSeen)
    ]
  )
| FirstSeen := formatTime(format="%Y-%m-%d %H:%M:%S", field=FirstSeen)
| LastSeen  := formatTime(format="%Y-%m-%d %H:%M:%S", field=LastSeen)
| sort(ConnectionCount, order=desc)

connections_to_tor_exit_nodes.yml

T1090.003

ByteRay GmbH

Hunting

Endpoint

Insight

2026-03-18

Connections to Tor Exit Nodes

Get this query running in your SIEM, with someone on call.