OpenVPN Connect Echo Script ACE - Server-Pushed Config Code Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the execution of unauthorized processes or file modifications associated with the 'OpenVPN Connect echo script' vulnerability (ACE). This rule specifically identifies process creation events involving command-line arguments that attempt to trigger script execution on VPN disconnect, even when the software's script permission setting is disabled.