OpenVPN Connect Echo Script ACE via Malicious Server-Pushed Config
Detects instances where the OpenVPN Connect client (OpenVPNConnect.exe or openvpn.exe) spawns unexpected child processes. This behavior is indicative of an exploit targeting the OpenVPN Connect 'echo' script ACE vulnerability, where a malicious VPN server pushes configuration directives (e.g., script.win.user.disconnect) that trigger arbitrary command execution on the client, potentially bypassing script permissions.
YARA-L
