Windows SoftEther VPN Masquerading as Legitimate Binary — Detection Rule
Flax Typhoon actors have been identified downloading and using SoftEther VPN software to obfuscate their activity. This searches for the SoftEther VPN binary running with the obfuscated binary names they use for the process.