Suspicious API call from a Tor exit node

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	Kubernetes - API
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Proxy: Multi-hop Proxy (T1090.003)
Severity	High

A cloud API was called from a Tor exit node.

Conceal information about malicious activities, such as location and network usage.

Block all web traffic to and from public Tor entry and exit nodes.

A Kubernetes API was called from a Tor exit node.

Conceal information about malicious activities, such as location and network usage.

Block all web traffic to and from public Tor entry and exit nodes.

A cloud API was called from a Tor exit node.

Conceal information about malicious activities, such as location and network usage.

Block all web traffic to and from public Tor entry and exit nodes.