LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

OneDriveStandaloneUpdater.exe

View source

OneDrive Standalone Updater

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

Download a file from the web address specified in `HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC`. `ODSUUpdateXMLUrlFromOC` and `UpdateXMLUrlFromOC` must be equal to non-empty string values in that same registry key. `UpdateOfficeConfigTimestamp` is a UNIX epoch time which must be set to a large QWORD such as 99999999999 (in decimal) to indicate the URL cache is good. The downloaded file will be in `%localappdata%\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json`.

COMMAND
OneDriveStandaloneUpdater
USE CASE
Download a file from the Internet without executing any anomalous executables with suspicious arguments
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
02 / ON DISK

Known paths

C:\Users\<username>\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe
C:\Program Files (x86)\Microsoft OneDrive\OneDriveStandaloneUpdater.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL

  • IOC

    Reports of downloading from suspicious URLs in %localappdata%\OneDrive\setup\logs\StandaloneUpdate_*.log files

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Elliot Killick@elliotkillick