Personal OneDrive Account Added on Corporate Device

F S@Fsdr

•updated Sep 25, 2025•56•10•1,046

Detects modifications to the Windows Registry by 'OneDrive.exe' when the initiating process command line does not correspond to a legitimate update operation. This could indicate an attempt to establish persistence or modify OneDrive's behavior for malicious purposes, potentially by an adversary using a compromised OneDrive account or malware like CreepyDrive.