YARA Rule for Onion Links

[Matt.Sharpe]

We are seeing some flags for "Onion Links" within the Malware Detection area. We however are not sure where to find the details of these detections.

Support have told us to perform some YARA scans (which isn't helpful for the NONE windows VMs that are alerting to Onion Links)...

Does anyone have any experience with this alert to guide us how to find the culprit Onion Link that is being detected?

Anything from YARA files that we could re-use to details on finding the link itself..

[rennerstefan]

Hi Matt,
did you already check the log files mentione here: post523959.html#p523959
Let us know if this helps or if you need further help.
Thanks