CL-STA-1062 SoftEther VPN Execution from Non-Standard Path
Detects execution of SoftEther VPN binaries (vpnclient, vpnserver, vpncmd, vpnbridge) from non-standard directories such as ProgramData, Temp, or AppData. It also identifies masquerading attempts where these binaries are renamed to vmtools.exe or vmwared.exe, and detects execution with specific VPN client/server command line flags outside of the expected installation directory. This rule is designed to identify covert tunneling activities and potential persistence mechanisms used by threat actors.
Sigma
