Fetching an onion service

tor_onion_fetch

Looks for a Tor SOCKS proxy on this host and, if one is listening, performs a full SOCKS5 handshake and fetches a published onion service through it. With no local proxy it falls back to a tor2web gateway over ordinary HTTPS, which needs no Tor software at all.

Severity high how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1071.001	Web Protocols	Command and Control	coverage statistics
T1090.003	Multi-hop Proxy	Command and Control	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other network and c2 tests

Other tests in the Network and C2 category.
Test	What it does	Severity
Beaconing pattern to a controlled endpoint c2_beacon_pattern	Sends a series of small, jittered HTTPS requests to a single endpoint with an attacker-shaped user agent and an opaque base64 body, producing the regu…	high
Reverse-shell style handshake c2_reverse_shell_handshake	Opens a raw TCP connection to a controlled host and exchanges shell-flavoured text over it — a prompt, a command name, a response — without any shell …	high
Outbound traffic to Tor directory authorities tor_node_egress	Attempts TCP connections to the Tor network's published directory authorities. Reaching them means an endpoint on this network could bootstrap Tor and…	high
Egress on non-standard ports c2_nonstandard_ports	Attempts outbound TCP connections on the ports malware habitually uses — 4444, 1337, 8080, 8443, 31337, 6667 — against a public service that answers o…	medium
Outbound traffic to Chinese networks cn_network_egress	Opens and immediately closes TCP connections to addresses in Chinese network ranges to establish whether geo-based egress filtering exists. No data is…	medium
Outbound SSH connection ssh_outbound_banner	Opens an SSH connection to a remote server and completes the protocol's identification exchange — reading the server's SSH-2.0 banner and sending our …	medium
Downloading the Tor Browser bundle tor_client_download	Fetches the official Tor Browser bundle from torproject.org to establish whether an anonymising client can be obtained on this network. The download i…	medium
Resolution of known-bad test domains malicious_dns_resolve	Resolves public malware/phishing test domains and looks for NXDOMAIN or sinkhole answers, which is how DNS filtering announces itself.	low

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.