Onedrive Directory Junction Creation

nomit vyas@xoxo

•updated Feb 8, 2026•0•27

Detects the creation of a directory junction pointing to a OneDrive synchronization folder. This is a key component of the 'DoubleDrive' technique, used to force the synchronization of arbitrary local files for data exfiltration or cloud-based ransomware encryption.