Windows Registry: OneDriveStandaloneUpdater.exe URL From UpdateOfficeConfig for Proxy Download

Alerts on registry settings that redirect OneDrive update URL retrieval from UpdateOfficeConfig for internet downloads.

FreeUnreviewedSigmahighv1

windows-registry-onedrivestandaloneupdater-exe-url-from-updateofficeconfig-for-p-3aff0be0

title: "Windows Registry: OneDriveStandaloneUpdater.exe URL From UpdateOfficeConfig for Proxy Download"
id: 847ac8ab-ee09-4e6b-afae-bb1e84da7181
status: test
description: This rule flags registry changes where the UpdateRingSettingURLFromOC path is set to a value that contains the OneDriveStandaloneUpdater.exe update URL-from-OC setting. Attackers can use this mechanism to redirect an update component to download attacker-controlled content without directly launching suspicious executables. It relies on Windows registry set telemetry capturing updates to the specified SOFTWARE\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC key.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/OneDriveStandaloneUpdater/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml
author: frack113, Huntrule Team
date: 2022-05-28
modified: 2023-08-17
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d
    type: derived

What it detects

This rule flags registry changes where the UpdateRingSettingURLFromOC path is set to a value that contains the OneDriveStandaloneUpdater.exe update URL-from-OC setting. Attackers can use this mechanism to redirect an update component to download attacker-controlled content without directly launching suspicious executables. It relies on Windows registry set telemetry capturing updates to the specified SOFTWARE\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC key.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.