VelvetCake OneDriveUpdateScheduler Task Persistence

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•5

Detects a suspicious sequence of events where a user or system initiates a PowerShell script (update1.ps1) via Windows Explorer in close temporal proximity (within 5 minutes) to the execution of known update-related tasks or scripts (OneDriveUpdateScheduler or update1.vbs). This correlation aims to identify potential persistence or malicious activity masquerading as update processes.