Darin Smith

Talk Title: Living Off the Tunnel: A Project for Tracking Evasive VPN Clients

Talk Abstract:

Commercial Virtual Private Network (VPN) tools, sometimes known as evasive VPNs, have legitimate privacy-preserving use cases but are also commonly used by threat actors for defense evasion. Even if installed legitimately, in an enterprise environment they can negatively impact network security monitoring and in some cases have been found to bundle other potentially unwanted applications such as residential proxy clients.

This talk introduces the Living Off the Tunnel Project: an open-source, community-driven repository of forensic profiles for evasive VPN clients. Modeled after the Living Off the Remote Monitoring and Management (LOLRMM), Living Off the Land Binaries and Scripts (LOLBAS), and other Living Off the Land projects, each profile documents cross-platform attributes of evasive VPN tools. These attributes include process names, installation artifacts, command-line arguments, network behavior, registry persistence, and known threat actor abuse cases across multiple platforms.

After introducing the project, we'll present the results of using it to test research hypotheses and develop detection rules, giving concrete examples of how to operationalize the intelligence. These hypotheses include questions such as whether running multiple evasive VPNs on the same device is suspicious, how threat actors can masquerade these utilities to avoid detection, and whether agentic AI tools can leverage evasive VPN clients to bypass enterprise controls.