VPN Usage

The subject establishes an outbound Virtual Private Network (VPN) connection from an organizational endpoint (or Bring-Your-Own-Device system) to an external VPN provider, proxy service, or remote-hosted infrastructure. This behavior may occur during early preparation for data exfiltration, coordination with external parties, or operational concealment.

VPN usage can allow a subject to bypass enterprise monitoring, obscure the true destination of outbound traffic, or simulate trusted connections. In some cases, VPN tunnels are used to bridge otherwise segmented environments, enabling access to personal devices, unmanaged infrastructure, or overseas collaborators.