Title:Tap Driver Installation Status:test Description:Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques References: -https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers Author: Daniil Yugoslavskiy, Ian Davis, oscd.community Date: 2019-10-24 modified:2022-12-25 Tags:
-'attack.exfiltration'
-'attack.t1048'
Logsource:
product: windows
service: system
Detection: selection: Provider_Name:
'Service Control Manager' EventID:
'7045' ImagePath|contains:
'tap0901' condition:selection Falsepositives:
-Legitimate OpenVPN TAP installation Level:medium
