OpenVPN Connect Echo-Script ACE — Unexpected Child Process or Marker File
Detects potentially malicious activity originating from or related to the OpenVPN Connect client. This includes the spawning of suspicious child processes (command interpreters and utilities), the creation of a known PoC-related marker file, and modifications to the AutoConfigURL registry value, which can be used to inject PAC (Proxy Auto-Configuration) URLs.
Cortex XDR
