TAP Driver Installation Detection
This rule detects the installation of a TAP (Tunnel Adapter) driver, specifically looking for 'tap0901' in the service's ImagePath. TAP drivers are commonly used by VPN software like OpenVPN to create virtual network interfaces, which can be leveraged for tunneling and data exfiltration. The detection aims to identify potential preparation for data exfiltration using tunneling techniques.
Sigma
