OneDrive Standalone Updater Located at: C:\Users\<username>\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe; C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe; C:\Program Files (x86)\Microsoft OneDrive\OneDriveStandaloneUpdater.exe.
onedrivestandaloneupdateronedrivestandaloneupdaterSandbox: execFile · Timeout: 30s
network.transfer.download Outputs
process.output Command execution output
network_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Download a file from the web address specified in `HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC`. `ODSUUpdateXMLUrlFromOC` and `UpdateXMLUrlFromOC` must be equal to non-empty string values in that same registry key. `UpdateOfficeConfigTimestamp` is a UNIX epoch time which must be set to a large QWORD such as 99999999999 (in decimal) to indicate the URL cache is good. The downloaded file will be in `%localappdata%\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json`. (Download a file from the Internet without executing any anomalous executables with suspicious arguments)
OneDriveStandaloneUpdater| Type | Rule / Indicator |
|---|---|
| ioc | HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL |
| ioc | Reports of downloading from suspicious URLs in %localappdata%\OneDrive\setup\logs\StandaloneUpdate_*.log files |
| sigma | https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml |
onedrivestandaloneupdater is a Windows LOLBin. OneDrive Standalone Updater Located at: C:\Users<username>\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe; C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe; C:\Program Files (x86)\Microsoft OneDrive\OneDriveStandaloneUpdater.exe.