This detection is used to detects the execution of TOR browser and it's components on windows systems.

If you need any further information, please reach out to me via Slack.

Slack ID - Vignesh Subramanian

1. Focused on detecting tor.exe and added the process_path field to detect TOR execution within Brave Browser. 

Brave Browser includes a built-in TOR client that is not explicitly named tor.exe during process creation; instead, it appears as tor-0.4.8.19-win32-brave-0. To capture this, I added the Brave Browser path to the detection logic to identify the presence of TOR within Brave. 

I also introduced wildcards in the path to support any version TOR binaries used by Brave, ensuring that different version numbers are correctly matched. 

2. Avoided using escape characters to improve readability.

3. The provided ID has been added.

4. The process field has been added as a threat object.

5. Additional tokens have been included in the risk-based alerting message to make it clearer and more meaningful.

6. The word “detection” has been removed from the title, which is now: "Windows TOR Client Execution"

7. Added the correct attack dataset link from (https://github.com/splunk/attack_data/blob/master/datasets/attack_techniques/T1090.003/windows_tor_client_execution/windows-sysmon.log)

Updated the detection configuration for Windows TOR Client Execution, including changes to the description, how to implement, known false positives, and drilldown searches.