GIFTEDCROOK VPN Config File Access by Suspicious or WinRAR-Spawned Process
Detects the access of VPN configuration files (e.g., .ovpn, .vpn, vpn*.conf) by common Windows command interpreters (powershell, pwsh, cmd, wscript, mshta) or archivers (WinRAR). This behavior is often indicative of automated credential harvesting or malicious configuration exfiltration, as legitimate VPN clients are explicitly excluded from this rule.
CQL
