SilentCanvas - Malicious OneDriveServers Service Creation

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects the creation of a persistent Windows service using 'sc.exe' that masquerades as 'OneDriveServers' to potentially run ScreenConnect, as observed in Operation SilentCanvas. This rule specifically looks for the 'sc.exe' utility being used with 'create' and 'OneDriveServers' in its command line arguments.