TAP Driver Installation - Security Event 4697

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•32

Detects the installation of a well-known TAP driver service, specifically looking for the 'tap0901' service file name. This activity could indicate preparation for data exfiltration using tunneling techniques, as TAP drivers are often used by VPN software like OpenVPN to create virtual network interfaces.