OpenVPN Connect PAC AutoConfigURL Injection via dhcp-option PROXY_AUTO_CONFIG_URL
Detects OpenVPN Connect applying a server-controlled PAC AutoConfigURL to HKCU Internet Settings, potentially enabling proxy interception of user traffic. This is achieved when a malicious VPN server pushes a dhcp-option PROXY_AUTO_CONFIG_URL, causing the OpenVPN system-level agent to write the attacker-controlled URL to the user's registry hive.
Microsoft Sentinel (KQL)
