SPECTRALVIPER XGU::Feature::Cmd Discovery via OneDrive.Sync.Service.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of discovery commands (e.g., whoami, tasklist, net user) spawned from the OneDrive.Sync.Service.exe process, consistent with behavior from the SPECTRALVIPER XGU module.