# detect-tor.gro

**URL:** <https://community.zeek.org/t/detect-tor-gro/4790>\
**Category:** Zeek\
**Created:** [April 19, 2017, 12:13pm UTC](https://community.zeek.org/t/detect-tor-gro/4790 "2017-04-19T12:13:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [April 19, 2017, 12:13pm UTC](https://community.zeek.org/t/detect-tor-gro/4790/1 "2017-04-19T12:13:12Z")

</div>

Hi,  
from below detect-tor script i need ssl session id, inside notice log

@load base/frameworks/notice

module DetectTor;

export {  
redef enum Notice::Type += {

## Indicates that a host using Tor was discovered.

DetectTor::Found  
};

## Distinct Tor-like X.509 certificates to see before deciding it’s Tor.

const tor\_cert\_threshold = 1.0;

## Time period to see the :bro:see:`tor_cert_threshold` certificates

## before deciding it’s Tor.

const tor\_cert\_period = 5min;

# Number of Tor certificate samples to collect.

const tor\_cert\_samples = 3 &redef;  
}

event bro\_init()  
{  
local r1 = SumStats::Reducer($stream=“ssl.tor-looking-cert”, $apply=set(SumStats::UNIQUE, SumStats::SAMPLE), $num\_samples=tor\_cert\_samples);  
SumStats::create([$name=“detect-tor”,  
$epoch=tor\_cert\_period,  
$reducers=set(r1),  
$threshold\_val(key: SumStats::Key, result: SumStats::Result) =  
{  
return result[“ssl.tor-looking-cert”]$unique+0.0;  
},  
$threshold=tor\_cert\_threshold,  
$threshold\_crossed(key: SumStats::Key, result: SumStats::Result) =  
{  
local r = result[“ssl.tor-looking-cert”];  
local samples = r$samples;  
local sub\_msg = fmt("Sampled certificates: ");

for ( i in samples )  
{  
if ( samples[i]?$str )  
sub\_msg = fmt(“%s%s %s”, sub\_msg, i==0 ? “”:“,”, samples[i]$str);  
print r;  
}  
NOTICE([$note=DetectTor::Found,  
$msg=fmt(“%s was found using Tor by connecting to servers with at least %d unique weird certs”, key$host, r$unique),  
$id= ??  
$session\_id=??  
$sub=sub\_msg,  
$src=key$host,  
$identifier=cat(key$host)]);  
}]);  
}

event ssl\_established(c: connection )  
{  
if ( c$ssl?subject && /^CN=www.[^=,]\*/ == c$ssl$subject && c$ssl?issuer && /^CN=www.[^=,]\*/ == c$ssl$issuer )  
{  
SumStats::observe(“ssl.tor-looking-cert”, [$host=c$id$orig\_h], [$str=c$ssl$subject]);  
}

#print c$ssl;  
}

Regards,  
Sunu

---

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [April 19, 2017, 12:14pm UTC](https://community.zeek.org/t/detect-tor-gro/4790/2 "2017-04-19T12:14:29Z")

</div>

Hi,  
from below detect-tor script i need ssl session id, and connection id (orig\_h,p etc), inside notice log

@load base/frameworks/notice

module DetectTor;

export {  
redef enum Notice::Type += {

## Indicates that a host using Tor was discovered.

DetectTor::Found  
};

## Distinct Tor-like X.509 certificates to see before deciding it’s Tor.

const tor\_cert\_threshold = 1.0;

## Time period to see the :bro:see:`tor_cert_threshold` certificates

## before deciding it’s Tor.

const tor\_cert\_period = 5min;

# Number of Tor certificate samples to collect.

const tor\_cert\_samples = 3 &redef;  
}

event bro\_init()  
{  
local r1 = SumStats::Reducer($stream=“ssl.tor-looking-cert”, $apply=set(SumStats::UNIQUE, SumStats::SAMPLE), $num\_samples=tor\_cert\_samples);  
SumStats::create([$name=“detect-tor”,  
$epoch=tor\_cert\_period,  
$reducers=set(r1),  
$threshold\_val(key: SumStats::Key, result: SumStats::Result) =  
{  
return result[“ssl.tor-looking-cert”]$unique+0.0;  
},  
$threshold=tor\_cert\_threshold,  
$threshold\_crossed(key: SumStats::Key, result: SumStats::Result) =  
{  
local r = result[“ssl.tor-looking-cert”];  
local samples = r$samples;  
local sub\_msg = fmt("Sampled certificates: ");

for ( i in samples )  
{  
if ( samples[i]?$str )  
sub\_msg = fmt(“%s%s %s”, sub\_msg, i==0 ? “”:“,”, samples[i]$str);  
print r;  
}  
NOTICE([$note=DetectTor::Found,  
$msg=fmt(“%s was found using Tor by connecting to servers with at least %d unique weird certs”, key$host, r$unique),  
$id= ??  
$session\_id=??  
$sub=sub\_msg,  
$src=key$host,  
$identifier=cat(key$host)]);  
}]);  
}

event ssl\_established(c: connection )  
{  
if ( c$ssl?subject && /^CN=www.[^=,]\*/ == c$ssl$subject && c$ssl?issuer && /^CN=www.[^=,]\*/ == c$ssl$issuer )  
{  
SumStats::observe(“ssl.tor-looking-cert”, [$host=c$id$orig\_h], [$str=c$ssl$subject]);  
}

#print c$ssl;  
}

Regards,  
Sunu

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/detect-tor-gro/4790/3 "2022-05-06T15:44:51Z")

</div>