Onedrive Process Injection
Detects process injection (e.g., process hollowing, remote thread creation) into legitimate OneDrive processes. Info-stealers use this technique to mask C2 communication as legitimate cloud traffic, bypassing network-based defenses.
YARA-L
