Windows Process Creation: tapinstall.exe Execution

title: "Windows Process Creation: tapinstall.exe Execution"
id: 6341dd12-6ec2-4290-bf3d-adecc88385a7
status: test
description: This rule flags execution of the Windows TAP installer binary (tapinstall.exe), which can be used to install virtual network adapters. Attackers may leverage TAP driver installation to set up tunneling or network access paths that support exfiltration activities. The detection relies on Windows process creation telemetry and matches process image paths ending with tapinstall.exe, while excluding common installer locations for specific VPN products.
references:
  - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tapinstall_execution.yml
author: Daniil Yugoslavskiy, Ian Davis, oscd.community, Huntrule Team
date: 2019-10-24
modified: 2023-12-11
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \tapinstall.exe
  filter_optional_avast:
    Image|contains:
      - :\Program Files\Avast Software\SecureLine VPN\
      - :\Program Files (x86)\Avast Software\SecureLine VPN\
  filter_optional_openvpn:
    Image|contains: :\Program Files\OpenVPN Connect\drivers\tap\
  filter_optional_protonvpn:
    Image|contains: :\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate OpenVPN TAP installation
level: medium
license: DRL-1.1
related:
  - id: 99793437-3e16-439b-be0f-078782cf953d
    type: derived