Cloud C2 via OneDrive/SharePoint API - Unusual Process Network Connection

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•3

Detects network connections to Microsoft OneDrive or SharePoint domains from processes that are not standard, known-good applications (e.g., browsers or standard sync clients). This behavior may indicate an adversary leveraging cloud storage for command-and-control (C2) operations or data exfiltration.