Anonymizer usage
Flags anonymizing-proxy / monitoring-circumvention tools on a managed endpoint — Tor, Psiphon, Ultrasurf, Hotspot Shield, or a SOCKS proxy to the Tor…
What it detects
Flags anonymizing-proxy / monitoring-circumvention tools on a managed endpoint — Tor, Psiphon, Ultrasurf, Hotspot Shield, or a SOCKS proxy to the Tor default port. Beyond the acceptable-use policy violation, these are used to evade network monitoring/DLP and reach blocked or malicious destinations.
MITRE ATT&CK mapping
False positives and triage
Security, research, and privacy testing legitimately use some of these. Confirm the user, whether the tool is sanctioned, and the destination. On a standard corporate workstation this is usually a reviewable policy violation.
Note the rule reads raw_message, so it also sees unparsed formats. If it fires on a developer or data-platform host, check the matched text before assuming an endpoint finding — application logs full of Java class names are the place a substring rule of this shape historically went wrong.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/multi/anonymizer_usage.yaml, licensed under the Apache License 2.0.
id: policy.anonymizer_usage
version: 1.1.0
status: experimental
severity: medium
confidence: 0.5
platforms: [windows, linux, macos]
mitre_techniques: [T1090.003, T1090]
description: |
Flags anonymizing-proxy / monitoring-circumvention tools on a managed endpoint — Tor,
Psiphon, Ultrasurf, Hotspot Shield, or a SOCKS proxy to the Tor default port. Beyond the
acceptable-use policy violation, these are used to evade network monitoring/DLP and reach
blocked or malicious destinations.
match:
# ONE anchored regex rather than a substring list. The executable names need a
# word boundary and the bare-substring form is actively dangerous: matching is
# case-insensitive, so `tor.exe` is a substring of `executor.Executor`. On a
# benign Apache Spark log that produced 606 findings claiming the host was
# running Tor — every line mentioning `org.apache.spark.executor.Executor`.
#
# A leading separator (line start, whitespace, path separator, quote, bracket)
# is what distinguishes an executable reference from the tail of a longer
# identifier. The remaining alternatives are distinctive enough as plain
# substrings and are kept verbatim.
raw_message_regex: '(?i)((^|[\s\\/"''(<=,;:])tor\.exe\b|torbrowser|tor browser|psiphon|ultrasurf|hotspot shield|socks5://127\.0\.0\.1:9050|127\.0\.0\.1:9150)'
false_positive_guidance: |
Security, research, and privacy testing legitimately use some of these. Confirm the user,
whether the tool is sanctioned, and the destination. On a standard corporate workstation
this is usually a reviewable policy violation.
Note the rule reads `raw_message`, so it also sees unparsed formats. If it fires on a
developer or data-platform host, check the matched text before assuming an endpoint
finding — application logs full of Java class names are the place a substring rule of
this shape historically went wrong.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.