Threat Hunting with Microsoft Defender XDR (including Defender for Endpoint): Investigating Tor Browser Activity

Investigating Tor Browser installation and network activity using Microsoft Defender XDR and KQL during a proactive threat hunting exercise