mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-12-25 14:29:24 +01:00
Update OneDriveStandaloneUpdater.yml
This commit is contained in:
parent
a509625acc
commit
58b5eb7513
@ -17,6 +17,8 @@ Full_Path:
|
||||
Detection:
|
||||
- IOC: HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL
|
||||
- IOC: Reports of downloading from suspicious URLs in %localappdata%\OneDrive\setup\logs\StandaloneUpdate_*.log files
|
||||
Resources:
|
||||
- Link: https://github.com/LOLBAS-Project/LOLBAS/pull/153
|
||||
Acknowledgement:
|
||||
- Person: Elliot Killick
|
||||
Handle: '@elliotkillick'
|
||||
|
Loading…
Reference in New Issue
Block a user