SPECTRALVIPER C2 via OneDrive.Sync.Services.exe masquerading process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects network connection events initiated by the OneDrive sync process (OneDrive.Sync.Services.exe) to known malicious domains or suspicious specific file paths, which may indicate unauthorized use of the OneDrive process for command-and-control communication or malicious file retrieval.