GraphWorm Uses OneDrive createUploadSession for Large Results

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects a non-OneDrive client invoking createUploadSession after creating staged command output or archives, indicative of GraphWorm activity.