SigmaHQ/rules/windows/process_creation/win_tap_installer_execution.yml

title: Tap Installer Execution
id: 99793437-3e16-439b-be0f-078782cf953d
description: Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
status: experimental
author: Daniil Yugoslavskiy, Ian Davis, oscd.community
date: 2019/10/24
tags:
    - attack.exfiltration
    - attack.t1048
logsource:
     category: process_creation
     product: windows
detection:
    selection:
        Image|endswith: '\tapinstall.exe'
    condition: selection
falsepositives:
    - Legitimate OpenVPN TAP insntallation
level: medium
Rule fixes Made tests pass the new CI tests. Added further allowed lower case words in rule test. 2020-02-20 22:00:16 +00:00			`title: Tap Installer Execution`
UUIDs + moved unsupported logic * Added UUIDs to all contributed rules * Moved unsupported logic directory out of rules/ because this breaks CI testing. 2019-12-19 22:56:36 +00:00			`id: 99793437-3e16-439b-be0f-078782cf953d`
OSCD QA wave 3 2020-01-19 21:34:16 +00:00			`description: Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques`
add tieto dns exfiltration rules 2019-10-25 02:30:55 +00:00			`status: experimental`
update authors for 2 rules 2019-12-07 01:10:06 +00:00			`author: Daniil Yugoslavskiy, Ian Davis, oscd.community`
add tieto dns exfiltration rules 2019-10-25 02:30:55 +00:00			`date: 2019/10/24`
			`tags:`
			`- attack.exfiltration`
			`- attack.t1048`
			`logsource:`
			`category: process_creation`
			`product: windows`
			`detection:`
			`selection:`
add tieto dns exfil rules 2019-11-10 17:27:21 +00:00			`Image\|endswith: '\tapinstall.exe'`
add tieto dns exfiltration rules 2019-10-25 02:30:55 +00:00			`condition: selection`
			`falsepositives:`
			`- Legitimate OpenVPN TAP insntallation`
			`level: medium`