Suspicious API call from a Tor exit node

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log OR Kubernetes Audit Logs
Detection Modules	Cloud
Detector Tags	Kubernetes - API, OCI Analytics
ATT&CK Tactic	Command and Control (TA0011), Initial Access (TA0001)
ATT&CK Technique	Proxy: Multi-hop Proxy (T1090.003), Valid Accounts: Cloud Accounts (T1078.004)
Severity	High

Description

A cloud API was called from a Tor exit node.

Attacker's Goals

Conceal information about malicious activities, such as location and network usage.

Investigative actions

Block all web traffic to and from public Tor entry and exit nodes.

Variations

Suspicious Kubernetes API call from a Tor exit node

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011), Initial Access (TA0001)
ATT&CK Technique	Proxy: Multi-hop Proxy (T1090.003), Valid Accounts: Cloud Accounts (T1078.004)
Severity	High

Description

A Kubernetes API was called from a Tor exit node.

Attacker's Goals

Conceal information about malicious activities, such as location and network usage.

Investigative actions

Block all web traffic to and from public Tor entry and exit nodes.

A Failed API call from a Tor exit node

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011), Initial Access (TA0001)
ATT&CK Technique	Proxy: Multi-hop Proxy (T1090.003), Valid Accounts: Cloud Accounts (T1078.004)
Severity	Informational

Description

A cloud API was called from a Tor exit node.

Attacker's Goals

Conceal information about malicious activities, such as location and network usage.

Investigative actions

Block all web traffic to and from public Tor entry and exit nodes.