Lolbas OneDriveStandaloneUpdater.exe Proxy Download

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•2

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json