OneDrive.exe Creating Files on Non-System Drives
Detects instances where the OneDrive sync client process creates files on drives other than the system drive (e.g., D: drive and beyond). This pattern is often used to identify potentially suspicious file synchronization activities or the use of secondary storage locations that may deviate from baseline OneDrive configurations.
Microsoft Sentinel (KQL)
