The use of Tor does show up on the network. The protocol is known and understood, and has been in the detection sets of pretty much every layer 7 filtering product for the last ten or eleven years. What, exactly, is being accessed is largely concealed (but traffic patterns give away a reasonably broad picture of what’s happening).