Windows Security 4697: TAP Driver Service Installation (tap0901)

Alerts on Windows Security EID 4697 service installation events for TAP driver files containing "tap0901."

FreeUnreviewedSigmalowv1

windows-security-4697-tap-driver-service-installation-tap0901-9c8afa4d

title: "Windows Security 4697: TAP Driver Service Installation (tap0901)"
id: 6c876da6-2def-4731-bad5-1c461fb3c2b2
related:
  - id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9
    type: derived
  - id: 9c8afa4d-0022-48f0-9456-3712466f9701
    type: derived
status: test
description: This rule flags Windows System Security audit EventID 4697 when a service driver file name contains "tap0901," indicating installation of a specific TAP driver service. Attackers may install network tunneling drivers to facilitate covert communication and potential data exfiltration. Detection relies on Security log auditing of service installation events (EID 4697) and the ServiceFileName field containing the driver identifier.
references:
  - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_tap_driver_installation.yml
author: Daniil Yugoslavskiy, Ian Davis, oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-11-29
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  product: windows
  service: security
  definition: "Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697"
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains: tap0901
  condition: selection
falsepositives:
  - Legitimate OpenVPN TAP installation
level: low
license: DRL-1.1

What it detects

This rule flags Windows System Security audit EventID 4697 when a service driver file name contains "tap0901," indicating installation of a specific TAP driver service. Attackers may install network tunneling drivers to facilitate covert communication and potential data exfiltration. Detection relies on Security log auditing of service installation events (EID 4697) and the ServiceFileName field containing the driver identifier.

Known false positives

Legitimate OpenVPN TAP installation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.