public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-11-04 02:29:34 +01:00
Code Issues Projects Releases Wiki Activity

Update OneDriveStandaloneUpdater.yml

Browse Source
This commit is contained in:
Oddvar Moe
2021-10-22 16:43:28 +02:00
committed by GitHub
parent a509625acc
commit 58b5eb7513
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
yml/OSBinaries/OneDriveStandaloneUpdater.yml
View File

@@ -17,6 +17,8 @@ Full_Path:
Detection:
- IOC: HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL
- IOC: Reports of downloading from suspicious URLs in %localappdata%\OneDrive\setup\logs\StandaloneUpdate_*.log files
Resources:
- Link: https://github.com/LOLBAS-Project/LOLBAS/pull/153
Acknowledgement:
- Person: Elliot Killick
Handle: '@elliotkillick'