Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Remote code execution exploit chain in OpenVPN

Steven Lim@KQLWizard

•updated Jul 1, 2025•9•1•101

KQL Query from file: Remote code execution exploit chain in OpenVPN

Microsoft Sentinel (KQL)

Tags

T1070.004 - File Deletion T1090 - Proxy T1573 - Encrypted Channel T1568 - Dynamic Resolution TA0005 - Defense Evasion TA0011 - Command and Control T1593.003 - Code Repositories T1116 - Code Signing TA0002 - Execution T1068 - Exploitation for Privilege Escalation TA0004 - Privilege Escalation S0683 - Peirates T1588.006 - Vulnerabilities T1212 - Exploitation for Credential Access T1210 - Exploitation of Remote Services TA0043 - Reconnaissance TA0042 - Resource Development TA0006 - Credential Access TA0008 - Lateral Movement Vulnerability Scan Detected Exploit Attempt Windows Linux macOS Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?