Title:Tap Driver Installation - Security Status:test Description:Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
References: -https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers Author: Daniil Yugoslavskiy, Ian Davis, oscd.community Date: 2019-10-24 modified:2022-11-29 Tags:
-'attack.exfiltration'
-'attack.t1048'
Logsource:
product: windows
service: security
definition: Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697
