Possible Tap Driver Deployment - Security (via security)

title: Possible Tap Driver Deployment - Security (via security)
id: e70ca325-50c6-52d2-836f-c65b676b33f8
status: stable
description: This rule detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
references:
    - https://attack.mitre.org/techniques/T1048/
    - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
author: Huntrule Team
date: 2026-03-15
tags:
    - attack.exfiltration
    - attack.t1048
logsource:
    product: windows
    service: security
    definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697'
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains: 'tap0901'
    condition: selection
falsepositives:
    - Unknown
level: low