Identifying the TorNodes IP address using the Azure Sentinel.

Tor IP addresses are tunneled through other devices on the Tor network with "Onion Routing". This prevents a user's real IP address from being exposed and instead proxies a request through other Tor devices.

If any of these IP addresses match a TOR node. Checking if an IP address appears in a list of known ToR exit nodes

- Create a watchlist ‘TorNodes’.

- Column name should be ‘ipaddress’

- Download the list of IP address from here: https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst

Once the watch list is configured below listed KQL query can be used: -

​let TorIPAddress = _GetWatchlist('TorNodes') | extend SourceIPAddress = ipaddress; BehaviorAnalytics

| join TorIPAddress on SourceIPAddress

let TorIPAddress = _GetWatchlist('TorNodes') | extend DestinationIPAddress = ipaddress;

BehaviorAnalytics

| join TorIPAddress on DestinationIPAddress

​let TorIPAddress = _GetWatchlist('TorNodes') | extend CallerIpAddress = ipaddress; AzureActivity | where CallerIpAddress != '' | extend Impacted_User = Caller, ResourceName = tostring(parse_json(Properties).resource) | join TorIPAddress on CallerIpAddress

| project TimeGenerated, SearchKey, OperationNameValue, Type, SubscriptionId, Impacted_User, ResourceName, ResourceGroup