Unauthorized Third-Party VPN Installation or Execution
This rule detects the installation or execution of a wide range of common third-party VPN clients by monitoring process creation events. It specifically looks for process names associated with over 100 different VPN services. The rule includes exclusions for legitimate security software like Microsoft Defender and Microsoft Intune Agent, as well as Cisco AnyConnect VPN client installations.
SentinelOne
