LOLVPN

Living Off The Land VPN: defensive queries and indicators for VPN-related software on endpoints. Same idea as LOLBAS and LOLRMM, focused on consumer VPN discovery via KQL (for now). Please contribute if you can!

GitHub repository · Maintainer

Want to contribute? Open a pull request or issue to suggest queries, indicators, or additional vendors to track.

Machine-readable list: queries.json (generated from each queries/<id>/manifest.yaml). Tracked vendor coverage: tracked-vpns.json (derived from KQL string lists + data/vpn-brands.yaml).

Tracked consumer VPNs

A searchable list of consumer VPNs tracked here via this project (plus path and uninstall-string variants on Windows). Logos use Simple Icons (CC0) when a glyph exists, otherwise initials for now.

0 vendors

Queries

0 queries