OneDrive.exeCLOUD STORAGEOneDrive.exe - Microsoft OneDrive Security Analysis
OneDrive.exe is the **Microsoft OneDrive cloud sync client**. Attackers abuse OneDrive for **data exfiltration** over trusted channels, **malware distribution** via shared files, and **C2 communication** using OneDrive API. Being built into Windows 10/11 makes it an attractive abuse target.
Risk Summary
MEDIUM priority for SOC triage. OneDrive.exe is a legitimate cloud sync client frequently abused for exfiltration and C2. Monitor for sensitive file sync, API abuse by non-OneDrive processes, and unusual sync activity.
Overview
What is OneDrive.exe?
OneDrive is Microsoft's cloud file storage and sync service.
Core Functions
File Sync:
- Cloud synchronization
- Selective sync
- Version history
- Sharing capabilities
Security Significance
- Built-in Windows: Pre-installed on Win 10/11
- Trusted Channel: Microsoft domain traffic
- API Access: Can be automated
- Enterprise Presence: Common in corporate
Normal Behavior
Normal Behavior
Expected Process State
| Property | Expected Value |
|---|---|
| Path | %LOCALAPPDATA%\Microsoft\OneDrive\OneDrive.exe |
| Parent | explorer.exe (startup) |
| User | Logged-in user |
| Network | onedrive.live.com, sharepoint.com |
Sync Folder
Default: %USERPROFILE%\OneDrive\
Business: %USERPROFILE%\OneDrive - CompanyName\
Common Locations
C:\Users\*\AppData\Local\Microsoft\OneDrive\OneDrive.exeSuspicious Indicators
Legitimate vs Suspicious
LEGITIMATE
Path: %LOCALAPPDATA%\Microsoft\OneDrive\OneDrive.exe
Network: Microsoft domains
Behavior: Normal file sync
SUSPICIOUS
Behavior: Syncing unusual directories
Large unexpected uploads
API calls from non-OneDrive process
Sync of credential files
Abuse Techniques
Attack Techniques
Technique #1: Data Exfiltration (T1567.002)
Exfil via Sync Folder:
- Copy sensitive files to OneDrive folder
- Automatic upload to cloud
- Difficult to detect
Technique #2: C2 via OneDrive API (T1102.002)
Using Microsoft Graph API:
- Upload/download commands
- Traffic appears legitimate
- Bypasses many controls
Technique #3: Malware Distribution
Sharing malware via OneDrive links.
Detection Guidance
Detection Strategies
Priority #1: Sensitive File Sync
FileSync TO OneDrive AND
FilePath CONTAINS ["passwords", "secrets", "credentials"]
→ ALERT: CRITICAL - Potential data theft
Priority #2: Non-OneDrive API Access
Process != "OneDrive.exe" AND
Network = "graph.microsoft.com" AND
Action = "file upload"
→ ALERT: HIGH - API abuse
Priority #3: Volume Anomaly
Unusual upload volumes.
Remediation Steps
Protection and Remediation
Defense: DLP Integration
Integrate OneDrive with DLP policies.
Defense: Conditional Access
Restrict OneDrive sync to managed devices.
If Compromise Suspected
- Review sync activity logs
- Check shared files/folders
- Audit API applications
- Review access logs in admin center
Investigation Checklist
Investigation Checklist
- Review recent sync activity
- Check for sensitive file uploads
- Audit shared links
- Review connected applications
- Check admin center logs