Investigating Curl-Based TOR Proxy Access with Uncoder AI and SentinelOne Query Language

Detecting stealthy command-line activity that may indicate dark web access or anonymized traffic is a growing challenge for security teams. Tools like curl.exe—while entirely legitimate—can be leveraged by advanced threats to route traffic through proxy networks or TOR.

This is where Uncoder AI’s Full Summary capability provides crucial context. When applied to SentinelOne Query Language (Events), the feature transformed a dense detection rule into a fully digestible narrative—highlighting both its purpose and potential impact.

Explore Uncoder AI

Detection Focus: Curl.exe with TOR or Proxy Indicators

This SentinelOne query targets executions of the curl.exe binary with command-line parameters suggesting interaction with:

SOCKS proxy protocols, such as socks5h://, socks5://, and socks4a://
Tor-specific endpoints, particularly URLs containing .onion

Input we used (click to show the text)

(TgtProcImagePath ContainsCIS “curl.exe” AND (TgtProcCmdLine ContainsCIS anycase “socks5h://” OR TgtProcCmdLine ContainsCIS anycase “socks5://” OR TgtProcCmdLine ContainsCIS anycase “socks4a://”) AND TgtProcCmdLine ContainsCIS anycase “.onion”)

These indicators point to attempts at routing traffic through anonymized proxy layers—commonly associated with dark web browsing, evasion techniques, or data exfiltration.

Full Summary Breakdown

Uncoder AI’s Full Summary automatically decomposed the rule into its key components:

Executable Match: The query triggers when the process path includes curl.exe, flagging usage of the standard command-line web client.
Command-Line Match: It specifically looks for known patterns (socks5h://, .onion, etc.) often used in anonymization or TOR access.

The AI explanation also contextualized these strings, noting their relevance to proxy-based communication, anonymity infrastructure, and malicious network behavior.

AI Output (click to show the text)

The s1-event in question appears to be related to the detection of potentially malicious activity involving the use of the `curl.exe` command-line tool with specific URL patterns. Here’s an extended summary:

**Event Overview**

This event is triggered when a process meets certain conditions, indicating possible interaction with dark web or anonymous networks through the `curl.exe` executable.

**Key Conditions**

**Executable Path**: The target process (`TgtProcImagePath`) must contain the path to `curl.exe`. This suggests that the process in question is an instance of the curl command-line tool.
**Command-Line Parameters**: The command line (`TgtProcCmdLine`) of the `curl.exe` process contains specific URL patterns, which are indicators of potential malicious or suspicious activity:

`socks5h://`, `socks5://`, or `socks4a://`: These strings indicate the use of SOCKS proxies. SOCKS is a protocol that allows internet traffic to be routed through a proxy server. The `h` in `socks5h` typically signifies that the hostname is resolved on the proxy side, which can help in hiding the actual destination.
`.onion`: This string is associated with Tor onion services. Onion services are used for hosting websites or other servers that wish to remain anonymous and are accessible through the Tor network.

**Implications**

The combination of these conditions suggests a few possible scenarios:

**Accessing Dark Web Resources**: The presence of `.onion` URLs indicates an attempt to access resources on the dark web, which is often associated with illicit activities. However, it’s also used for legitimate purposes such as protecting user privacy.
**Use of Proxies for Anonymity**: The use of SOCKS proxies (as indicated by `socks5h://`, `socks5://`, or `socks4a://`) can be an attempt to anonymize internet traffic. While proxy usage is common and not inherently malicious, in the context of accessing onion services or other potentially sensitive content, it may raise security concerns.
**Potential Evasion Techniques**: Malicious actors might use these methods (anonymizing proxies and dark web resources) as part of their tactics, techniques, and procedures (TTPs) to evade detection or hide their tracks during an attack.

**Response**

When this s1-event is triggered, it warrants further investigation to understand the context and intent behind the activity. This could involve:

Reviewing network logs for other suspicious activity.
Analyzing the system’s behavior before and after the event to identify potential precursors or consequences of the detected action.
Inspecting the system for any signs of malware or unauthorized access attempts.

Given the nature of this event, it’s crucial to balance security vigilance with an understanding that not all activities involving these indicators are malicious. Legitimate uses might include research, privacy protection, or accessing onion services for secure communication.

Why It Matters

While not all uses of SOCKS proxies or .onion domains are malicious, in endpoint telemetry, their appearance within curl.exe activity is uncommon and potentially risky. Attackers can abuse this method to:

Bypass traditional logging and visibility
Reach out to hidden C2 servers on the dark web
Move data off-network without detection

This type of behavior, especially when automated or repeated, can be indicative of advanced tooling—such as the Kalambur backdoor or other TOR-enabled implants.

Security Response Enablement

With Full Summary, defenders instantly understand what the detection looks for and why it matters. It supports quicker decision-making around response actions, including: