OpenVPN Connect Echo-Script ACE - Unexpected Child Process Spawned
Detects instances where the OpenVPN Connect client (OpenVPNConnect.exe or openvpn.exe) spawns unexpected child processes, such as cmd.exe, powershell.exe, or wscript.exe. This behavior is associated with the exploitation of server-pushed echo-scripts, which can lead to arbitrary code execution on the client system.
Sigma
