public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-25 14:29:24 +01:00
Code Issues Projects Releases Wiki Activity

Update OneDriveStandaloneUpdater.yml

Browse Source
This commit is contained in:
Oddvar Moe 2021-10-22 16:41:56 +02:00 committed by GitHub
parent 70a061d301
commit a509625acc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
yml/OSBinaries/OneDriveStandaloneUpdater.yml
View File

@ -13,7 +13,7 @@ Commands:
MitreLink: https://attack.mitre.org/techniques/T1105/ MitreLink: https://attack.mitre.org/techniques/T1105/
OperatingSystem: Windows 10 OperatingSystem: Windows 10
Full_Path: Full_Path:
- Path: %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - Path: '%localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe'
Detection: Detection:
- IOC: HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL - IOC: HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL
- IOC: Reports of downloading from suspicious URLs in %localappdata%\OneDrive\setup\logs\StandaloneUpdate_*.log files - IOC: Reports of downloading from suspicious URLs in %localappdata%\OneDrive\setup\logs\StandaloneUpdate_*.log files