Lolbas OneDriveStandaloneUpdater.exe Proxy Download

Title: Lolbas OneDriveStandaloneUpdater.exe Proxy Download
Status: test
Description:Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
References:
  -https://lolbas-project.github.io/lolbas/Binaries/OneDriveStandaloneUpdater/
Author: frack113
Date: 2022-05-28
modified:2023-08-17
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\SOFTWARE\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC'
  condition:selection
Falsepositives:
  -Unknown
Level: high