Analytics BIOC High
✕

A Successful VPN connection from TOR

A successful VPN connection from a TOR exit node.

Module:
Identity Analytics
Data source:
Palo Alto Networks Global Protect, Third-Party VPNs
ATT&CK tactics: Initial Access (TA0001) Command and Control (TA0011)
ATT&CK techniques: Proxy: Multi-hop Proxy (T1090.003) Valid Accounts (T1078)
Attacker's goals:

Gain initial access to organization and hiding itself.

Investigative actions:

Block all web traffic to and from public Tor entry and exit nodes. Search for additional logins from the same user around the alert timestamp.

Test period:
N/A (single event)
Deduplication:
1 Hour
1 variation:
  • A Successful VPN connection from TOR via Mobile Device Medium (parent: High)