SilentCanvas - OneDriveServers Persistence Service

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

Detects sc.exe creating a Windows service named OneDriveServers to mask ScreenConnect persistence, as observed in Operation SilentCanvas.