Black Basta BackConnect OneDrive DLL Sideload
This rule detects the execution of 'OneDriveStandaloneUpdater.exe' with the '-Embedding' command-line argument, specifically when it is not launched by legitimate parent processes like 'OneDrive.exe', 'svchost.exe', or 'SearchHost.exe'. This behavior is indicative of potential DLL sideloading, a technique used by malware such as Black Basta's BackConnect, where the updater is launched post-exploitation from an unusual location (e.g., AppData) to load malicious DLLs. The rule aims to identify suspicious instances of this updater being used as a staged malware component rather than for legitimate OneDrive updates.
Sigma
