Update OneDriveStandaloneUpdater.yml

This commit is contained in:
Oddvar Moe
2021-10-22 16:43:28 +02:00
committed by GitHub
parent a509625acc
commit 58b5eb7513

View File

@@ -17,6 +17,8 @@ Full_Path:
Detection:
- IOC: HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL
- IOC: Reports of downloading from suspicious URLs in %localappdata%\OneDrive\setup\logs\StandaloneUpdate_*.log files
Resources:
- Link: https://github.com/LOLBAS-Project/LOLBAS/pull/153
Acknowledgement:
- Person: Elliot Killick
Handle: '@elliotkillick'