Windows Service Creation for TAP Driver Installation (Service Control Manager 7045)

Flags Windows service installation events for TAP driver image paths containing 'tap0901'.

FreeUnreviewedSigmamediumv1

windows-service-creation-for-tap-driver-installation-service-control-manager-704-8e4cf0e5

title: Windows Service Creation for TAP Driver Installation (Service Control Manager 7045)
id: c36db1e0-3163-49e6-86c6-372560a2af85
status: test
description: This rule identifies Windows service creation events (EventID 7045) where the service image path contains the TAP driver identifier 'tap0901'. Attackers may use legitimate TAP drivers or similar tunneling network drivers to prepare for traffic tunneling and potential data exfiltration. The detection relies on System logs from the Service Control Manager, specifically the service provider name and the image path field.
references:
  - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_tap_driver.yml
author: Daniil Yugoslavskiy, Ian Davis, oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-12-25
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains: tap0901
  condition: selection
falsepositives:
  - Legitimate OpenVPN TAP installation
level: medium
license: DRL-1.1
related:
  - id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9
    type: derived

What it detects

This rule identifies Windows service creation events (EventID 7045) where the service image path contains the TAP driver identifier 'tap0901'. Attackers may use legitimate TAP drivers or similar tunneling network drivers to prepare for traffic tunneling and potential data exfiltration. The detection relies on System logs from the Service Control Manager, specifically the service provider name and the image path field.

Known false positives

Legitimate OpenVPN TAP installation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.