OpenVPN Connect echo-script ACE — unexpected child process spawned
Detects instances where the OpenVPN Connect process spawns unexpected child processes. This behavior is consistent with the exploitation of OpenVPN ACE (Access Control Exploitation) vulnerabilities, where a malicious OpenVPN server pushes an 'echo' directive that decodes to a command and executes upon disconnection, bypassing client-side script execution restrictions.
YARA-L
