Persistence via OneDrive Update Scheduled Task and HKCU Registry Counter

Duo Tech@duotech

•updated Jul 21, 2026•1•0•4

Detects potential persistence mechanisms that mimic or leverage the Microsoft OneDrive update process. This includes the creation or modification of scheduled tasks containing 'OneDrive Update' in the command line using tools like schtasks or PowerShell, as well as modifications to the HKCU OneDrive environment registry key, a behavior associated with the GigaWiper malware.