Suspicious Process Masquerading as OneDrive

Rule Info

Name
Suspicious Process Masquerading as OneDrive
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects suspicious process that is masquerading as OneDrive executable. This technique can be used by attackers to evade detection by running malicious processes under the guise of a legitimate application.
Reference
https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations
Date
2026-03-16 00:00:00
Modified
None
Id
329359e1-48e0-4210-8c0f-fbc223af68f8
Tags
attack.t1036.005 attack.defense-evasion
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022