Abnormal network communication through TOR using an uncommon port

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Platform Logs OR XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071) Non-Standard Port (T1571)
Severity	Low

Suspicious connection from a known TOR IP to an uncommon port.

Attackers might use TOR IP combined with random ports.to hide C2 inbound communication from inside a host.

Investigate the network configuration related to the participating port.
Investigate processes that were listening to that port.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Suspicious connection from a known TOR IP to an uncommon port and App-id.

Attackers might use TOR IP combined with random ports.to hide C2 inbound communication from inside a host.

Investigate the network configuration related to the participating port.
Investigate processes that were listening to that port.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Suspicious connection from a known TOR IP to an uncommon potential C2 communication port.

Attackers might use TOR IP combined with random ports.to hide C2 inbound communication from inside a host.

Investigate the network configuration related to the participating port.
Investigate processes that were listening to that port.