Tap Installer Execution

Title: Tap Installer Execution
Status: test
Description:Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
References:
  -https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
Date: 2019-10-24
modified:2023-12-11
Tags:

• -'attack.exfiltration'
• -'attack.t1048'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\tapinstall.exe'
  filter_optional_avast:
    Image|contains:
      -':\Program Files\Avast Software\SecureLine VPN\'
      -':\Program Files (x86)\Avast Software\SecureLine VPN\'

  filter_optional_openvpn:
    Image|contains: ':\Program Files\OpenVPN Connect\drivers\tap\'
  filter_optional_protonvpn:
    Image|contains: ':\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\'
  condition:selection and not 1 of filter_optional_*
Falsepositives:
  -Legitimate OpenVPN TAP installation
Level: medium