Connection to an onion-routing relay or local SOCKS proxy port

Siemphony@siemphonymediumT1090.003unverified

AN1020 pairs an anonymity client with sustained outbound traffic, and the part of that a single connection event can carry is the destination port, so this rule matches host-initiated connections to the onion-routing relay and directory ports and to the SOCKS and control ports that the standard and browser-bundled clients listen on locally. The analytic's other source, DNS query, is not used: an onion-aware client resolves .onion names inside the SOCKS tunnel and never through the system resolver, so a QueryName selector on that suffix would validate cleanly, render in four backends and never fire. The I2P proxy ports 4444 and 4445 are left out because they collide with development and test listeners often enough to dominate the rule. Sysmon EventID 3 is off in a bare install and most shipped configurations drop loopback traffic, which removes the local SOCKS half of this rule entirely — zero rows there means the filter, not the absence of a proxy. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0359, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (Initiated="true" AND (DestinationPort="9001" OR DestinationPort="9030" OR DestinationPort="9040" OR DestinationPort="9050" OR DestinationPort="9051" OR DestinationPort="9150" OR DestinationPort="9151"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="DestinationPort" type="pcre2">(?i)(^9001$|^9030$|^9040$|^9050$|^9051$|^9150$|^9151$)</field>    <description>Connection to an onion-routing relay or local SOCKS proxy port</description>    <mitre>      <id>T1090.003</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ca64529c-19ec-41c2-8773-b1fbbb2f9952

ATT&CKT1090.003

T1090.003Multi-hop Proxy

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

AN1020 describes a compound behavior: an anonymity client launched as a process, sustained encrypted outbound traffic to known anonymity infrastructure, and possibly onward relaying to internal systems via reverse proxying, ICMP tunneling, or socket forwarding. This rule covers a single slice of that — one Sysmon EventID 3 connection event to a fixed port list. It says nothing about the launching process, the sustained/duration element, or the internal-relay half of the analytic. This is precursor-only coverage: a hit means "a host touched Tor infrastructure," not "a multi-hop chain was observed."

02 · Telemetry you need

Sysmon EventID 3 (network_connection/windows), fields Initiated and DestinationPort. Two gaps worth knowing: EID 3 is off in a bare Sysmon install and most shipped configs drop loopback traffic, which silently removes the local-SOCKS half of this rule (ports 9150/9151) — zero hits there means the filter, not a clean host. EID 22 (DNS), also listed under AN1020, is deliberately unused: onion-aware clients resolve .onion names inside the SOCKS tunnel, never through the system resolver, so a QueryName selector would validate and render but never fire. Translations: Splunk, Elastic ESQL, and Wazuh render the rule; Sentinel refuses it because Initiated has no Sentinel column — Defender expresses connection direction via ActionType, not a boolean field.

03 · How the logic works

One selection block, two fields ANDed: Initiated: 'true' and DestinationPort against a seven-value list — 9001, 9030, 9040, 9050, 9051, 9150, 9151. condition: selection. There is no process/Image selector at all, and that's deliberate: it sidesteps the classic EID-3 "socket owner" trap where the reporting process is a wrapper, not the actual proxy binary. The ports split into two groups: 9001/9030/9040 are Tor relay and directory ports (in-network hop traffic), while 9050/9051 and 9150/9151 are the standard daemon's and the Tor Browser bundle's local SOCKS/control ports. I2P 4444/4445 were deliberately left off — they collide too often with development and test listeners to be worth the noise.

04 · Common false positives

Port 9001 is registered to several database and management products and is called out as "by far the most likely benign match" — on an estate running one, every client generates continuous matches, and destination-address exclusion is required before this rule is usable at all. Behind it: staff legitimately running the Tor Browser bundle (9150/9051 traffic indistinguishable from adversary use by design), security-research or threat-intel workstations that reach onion services on purpose, and port/vulnerability scanners sweeping ranges that touch every port in the list against every target.
The reviewer's central catch: AN1020 asks for sustained traffic that may relay onward, but Sigma has no duration or aggregation construct, so the rule collapses that into a single connection event. It cannot distinguish a one-off failed connection attempt from genuine multi-hop relay behavior — it detects "talked to Tor infrastructure," not chaining. That's a defensible proxy given Tor's onion routing is inherently multi-hop, not a flaw to apologize for, but it should not be read as behavioral proof.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE's scaffold and never executed against real logs. The port selections and exclusions reflect review judgment, not measured hit rates. Sentinel's refusal narrows real-world validation to three backends, and even there the 9001 false positive should be expected to dominate until an exclusion list is built from actual traffic.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude known 9001 line-of-business hosts by destination address first —
Add downstream aggregation — distinct destination IPs per host per time
MITRE's DomainCategory and ProcessParent knobs are unused here; adding
Note the evasion gap: pluggable transports (obfs4, meek, Snowflake) or a

Declared by the author

Line-of-business and vendor software bound to 9001, which is registered to several database and management products and is by far the most likely benign match in this list. On an estate that runs one, every client of that server matches continuously and the destination address has to be excluded before the rule is usable at all.
Privacy-conscious staff running the browser bundle on a corporate laptop. Its connections to the local SOCKS listener on 9150 and to guard relays on 9001 are exactly the events this rule looks for, with no adversary behind them.
Security research, malware analysis and threat-intelligence workstations that reach onion services deliberately, and any host running a sanctioned relay or bridge.
Port scanners and vulnerability-assessment agents sweeping wide ranges from a scanning host, which produce host-initiated connections on every port in this list against every target in scope.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1090.003, evaluated against their network_connection events.

Share this rule

/u/siemphony/ca64529c-19ec-41c2-8773-b1fbbb2f9952

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Connection to an onion-routing relay or local SOCKS proxy port

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it