Non-browser process using Google Drive, OneDrive and Yandex.Disk cloud C2

ills3c Intel&Coffee@Ills3C

•updated 4 days ago•2•0•3

Detects non-browser processes contacting multiple distinct cloud storage APIs within a one-hour timeframe, a pattern indicative of potential multi-service command and control or data exfiltration.