EXT-06 Extraction · Exfiltration & C2 KQL YARA

Tor / Proxy / VPN Anonymization Channels

Mappings

MITRE ATT&CK

T1090.003 Multi-hop Proxy (Tor)T1572 Protocol Tunneling

CVE examples

Not vulnerability-based — this capability is behavioural.

MalwareBazaar

tor LockBit

Summary

Tor / Proxy / VPN Anonymization Channels refers to the use of network routing mechanisms designed to obscure the origin, destination, or identity of communication between a target environment and external systems. This includes routing traffic through anonymization networks, proxy servers, or virtual private networks to conceal attacker infrastructure and maintain covert communication. Within MalChain, this capability begins once outbound traffic is intentionally routed through anonymization services to evade monitoring or attribution. Attackers exploit implicit trust in encrypted network tunnels and privacy-focused communication technologies to move data or maintain command channels without revealing their true location. Routine reliance on remote access and secure connectivity often allows anonymized traffic to blend with legitimate network activity. Trust abuse may involve establishing hidden tunnels, redirecting communication through intermediary servers, or masking network identity presented as legitimate remote access behavior. Common anonymization methods include:

Routing traffic through Tor or anonymization networks
Establishing outbound connections through proxy servers
Creating encrypted VPN tunnels to external infrastructure
Redirecting network communication through intermediary hosts
Using layered routing to conceal communication paths

Real world usage includes:

Covert command-and-control communication in intrusion campaigns
Data exfiltration operations avoiding geographic attribution
Ransomware operators masking infrastructure locations
Persistent threats maintaining anonymous remote access channels

Detection Guidance

Detection relies on monitoring network routing behavior, connection patterns, and communication anomalies associated with anonymization services. Contextual correlation between network traffic and system activity is essential to reduce false positives.

Monitor outbound connections to known anonymization networks
Detect unusual encrypted tunnels or proxy connections
Correlate anonymized traffic with sensitive data access events
Alert on repeated connections to unfamiliar network endpoints
Identify rare or unauthorized use of anonymization services

KQL Detection Concepts

Network events indicating connections to proxy or anonymization services
Encrypted tunnel creation or VPN connection activity
Repeated outbound communication to rotating network addresses

YARA Detection Concepts

Scripts or binaries implementing anonymization routing logic
Code patterns associated with proxy or VPN communication
Executable components establishing hidden network tunnels

KQL Detection Rule

kql

// Tor / Proxy / VPN Anonymization: connections to Tor / anonymizer infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (".onion","torproject.org") or InitiatingProcessFileName in~ ("tor.exe","obfs4proxy.exe","psiphon.exe")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName

YARA Detection Rule

yara

rule MC_EXT_06_Tor_Anonymizer_Artifacts
{
    meta:
        author = "MalChain"
        technique = "MC-EXT-06 Tor / Proxy / VPN Anonymization Channels"
        description = "Embedded Tor / onion routing artifacts"
    strings:
        $a = ".onion" ascii nocase
        $b = "tor.exe" ascii nocase
        $c = "obfs4proxy" ascii nocase
        $d = "SOCKS5" ascii
        $e = "torrc" ascii nocase
    condition:
        2 of them
}