OneDrive Forensics & Sync Client Exfiltration

DFIR Investigation Charter

The Silent Vacuum of User Drives: OneDrive for Business represents the most intimate data silo in Microsoft 365, housing personal working documents, desktop sync backups, credentials in unencrypted text files, and sensitive financial records. Threat actors systematically abuse the OneDrive Sync Client (onedrive.exe) to execute automated, background exfiltration of entire user directories. This reference card details the cloud audit telemetry, sync mechanics, and local endpoint artifacts required to prove exfiltration.

1. OneDrive for Business Architecture

Under the hood, OneDrive for Business is not an independent storage product; each user’s OneDrive is provisioned as an isolated personal SharePoint site collection residing within the tenant’s personal namespace:

https://contoso-my.sharepoint.com/personal/user_contoso_com/

graph TD
    subgraph CloudNamespace ["Microsoft 365 Personal Namespace (contoso-my.sharepoint.com)"]
        SiteColl["Personal Site Collection (/personal/user_contoso_com)"]
        RootFolder["Root Document Library ('Documents')"]
        KFM["Known Folder Move (Desktop, Documents, Pictures)"]
        OneNoteFolder["OneNote Notebooks & AppData"]
    end

    subgraph AccessMechanisms ["Access Modalities"]
        WebBrowser["Web Browser (OWA / O365 Portal)"]
        SyncClient["OneDrive Sync Client (onedrive.exe)"]
        MobileApp["OneDrive iOS / Android App"]
        GraphAPI["Microsoft Graph API (/me/drive)"]
    end

    subgraph AuditTelemetry ["Purview UAL & Client Telemetry"]
        CloudAudit["Purview UAL (OneDrive Workload)"]
        LocalLogs["Endpoint ODL Logs (SyncEngine.odl)"]
        SQLiteDB["Local Sync Settings & Hash Stores"]
    end

    AccessMechanisms --> CloudNamespace
    SyncClient -.-> LocalLogs
    SyncClient -.-> SQLiteDB
    AccessMechanisms --> CloudAudit

Key Differences Between SharePoint and OneDrive Forensics

Forensic Dimension	SharePoint Online	OneDrive for Business
Site Collection Path	/sites/<SiteName>/	/personal/<user>_<domain>_com/
Primary Administrator	Site Collection Admins / Group Owners	Individual user account (owner by default)
Known Folder Move (KFM)	Not applicable	Syncs user desktop, documents, and pictures folders automatically
Default Sync Client	Selective document library sync	Full personal drive sync by default (onedrive.exe)
Secondary Administration	Centralized governance	Requires tenant admin to inject secondary admin via PowerShell

---

2. Exfiltration via OneDrive Sync Client (onedrive.exe)

The most prevalent and damaging exfiltration vector observed in cloud intrusions is Sync Exfiltration:

1. The adversary compromises a user’s credentials or obtains a valid PRT / session cookie.
2. The attacker configures the native OneDrive client (onedrive.exe on Windows or macOS) on an unmanaged, attacker-controlled computer.
3. Upon authenticating, the OneDrive client automatically negotiates a sync partnership and begins downloading the entire contents of the victim’s OneDrive drive and synchronized SharePoint libraries.

sequenceDiagram
    autonumber
    actor Attacker as Threat Actor (External Machine)
    participant Entra as Microsoft Entra ID
    participant ODB as OneDrive Service (/personal/...)
    participant UAL as Purview Unified Audit Log
    participant Host as Attacker Filesystem

    Attacker->>Entra: Authenticate via stolen credentials / session token
    Entra-->>Attacker: Issue Access Token for SharePoint/OneDrive Resource
    Attacker->>ODB: Initialize OneDrive Sync Client (onedrive.exe)
    ODB->>UAL: Log 'FileSyncClientLoggedOn' (IP: Attacker IP, Client: OneDriveSync)
    ODB->>Host: Stream files via background delta sync (Cobalt / HTTP)
    ODB->>UAL: Log 'FileSyncDownloadedFull' for EVERY synchronized file!
    Note over Host: Complete user document repository mirrored locally
    Note over UAL: 'FileSyncDownloadedFull' provides definitive PROOF of exfiltration!

The Invaluable Signature: FileSyncDownloadedFull

Unlike browser interactions where users preview files (FileAccessed), sync client transfers generate a dedicated, unambiguous UAL audit event:

{
  "Workload": "OneDrive",
  "Operation": "FileSyncDownloadedFull",
  "UserId": "victim@contoso.com",
  "ClientIP": "203.0.113.88",
  "UserAgent": "Microsoft SkyDriveSync 26.045.0302.0001",
  "SourceFileName": "Executive_Salaries_2026.xlsx",
  "SourceRelativeUrl": "Documents/Confidential/Executive_Salaries_2026.xlsx"
}

• Evidentiary Standard: Proven (Tier 7). Confirms that the binary payload was transferred in its entirety to the client endpoint.

---

3. Endpoint Artifact Correlation (Client-Side Forensics)

When investigators possess forensic access to the endpoint where synchronization occurred (or when investigating whether an insider or compromised corporate workstation downloaded data), local artifacts confirm sync operations:

graph LR
    subgraph EndpointArtifacts ["Local Windows Endpoint Artifacts (%LOCALAPPDATA%\Microsoft\OneDrive)"]
        ODLLogs["*.odl / *.odlgz Logs<br/>(Obfuscated Developer Logs - SyncEngine)"]
        SyncEngine["SyncEngine.odl<br/>(Contains file hashes, download timestamps, chunk stats)"]
        SQLite["settings\Personal\*.dat<br/>(SQLite configuration and sync state databases)"]
        KFMConfig["ClientPolicy.ini<br/>(Tenant ID, User CID, Sync root paths)"]
    end

    SyncEngine --> SQLite

1. Obfuscated Developer Logs (.odl)

Located under:

%LOCALAPPDATA%\Microsoft\OneDrive\logs\Personal\
%LOCALAPPDATA%\Microsoft\OneDrive\logs\Business1\

• SyncEngine.odl: Contains low-level logging of every sync transaction, file download, chunk transfer, and hash comparison.
• De-obfuscation: Files are lightly encoded. The open-source tool OneDriveODL or specialized forensic parsers can decode .odl and .odlgz files into plain text, extracting filenames, file sizes, and download completion timestamps.

2. Client State & Sync Settings Databases

Located under:

%LOCALAPPDATA%\Microsoft\OneDrive\settings\Personal\

• ClientPolicy.ini: Documents the authenticated tenant GUID, User CID, and organizational synchronization policies.
• [UserCID].dat: Stores SQLite database tracking synchronized item paths, local filesystem mapping, and last sync sequence numbers.

---

4. Web UI Bulk Exfiltration vs Direct Downloads

If an attacker cannot initialize the desktop sync client (e.g., blocked by Conditional Access device compliance policies), they resort to web browser exfiltration:

1. Multi-File Zip Packaging

When an attacker selects multiple files or an entire folder in the OneDrive web interface and clicks Download, OneDrive compresses the items on the fly into a single .zip file.

• Audit Signature: A rapid cluster of FileDownloaded events occurring within seconds, sharing identical client IP addresses, session IDs, and user agents.
• User Agent Artifact: Often includes OneDriveBrowserSync or standard browser user agents with specific referer paths (/_layouts/15/download.aspx).

2. External Sharing Injection

Adversaries who maintain ongoing access inject their external personal accounts as direct editors of the OneDrive root folder:

• Operation: SharingSet or AddedToSecureLink.
• Target: Root folder Documents.
• Impact: Once added, the attacker can browse and sync the victim’s OneDrive from their own home computer using their personal account, without ever authenticating to the victim’s corporate tenant again!

---

5. Detection Engineering: OneDrive Hunting Queries

KQL: Sync Client Exfiltration Spike

// Detect massive sync downloads indicative of sync client exfiltration
CloudAppEvents
| where TimeGenerated >= ago(7d)
| where ActionType == "FileSyncDownloadedFull"
| extend Workload = tostring(RawEventData.Workload)
| where Workload =~ "OneDrive"
| extend ClientIP = tostring(RawEventData.ClientIP)
| extend FileName = tostring(RawEventData.SourceFileName)
| summarize
    DownloadedFilesCount = count(),
    Files = make_set(FileName, 20)
    by AccountDisplayName, ClientIP, bin(TimeGenerated, 1h)
| where DownloadedFilesCount > 100
| sort by DownloadedFilesCount desc

KQL: OneDrive Root Folder Sharing

// Detect external sharing applied to the root Documents folder of OneDrive
CloudAppEvents
| where TimeGenerated >= ago(14d)
| where ActionType in ("SharingSet", "AddedToSecureLink", "AnonymousLinkCreated")
| extend Workload = tostring(RawEventData.Workload)
| where Workload =~ "OneDrive"
| extend TargetPath = tostring(RawEventData.SourceRelativeUrl)
| where TargetPath in ("", "Documents", "/") or TargetPath !contains "/"
| project TimeGenerated, AccountDisplayName, ActionType, TargetPath, RawEventData
| sort by TimeGenerated desc

PowerShell: Extract OneDrive Secondary Admins

<#
.SYNOPSIS
    Scans a victim's OneDrive site collection for unauthorized secondary administrators.
#>
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

$UserUrl = "https://contoso-my.sharepoint.com/personal/victim_contoso_com"
$Admins = Get-SPOUser -Site $UserUrl | Where-Object {$_.IsSiteAdmin -eq $true}

Write-Host "[+] Site Administrators for $UserUrl :" -ForegroundColor Cyan
$Admins | Select-Object DisplayName, LoginName, IsGroup

---

6. Incident Response Playbook: Step-by-Step Triage

1. Sever Sync Partnerships & Revoke Sessions: Immediately terminate the user’s active Entra ID refresh tokens and invalidate sync partnerships:

   Revoke-MgUserSignInSession -UserId "victim@contoso.com"

2. Audit and Remove Secondary Site Collection Administrators: Attackers often assign themselves secondary admin rights to maintain persistent access to the victim’s OneDrive:

   # Remove unauthorized secondary administrator from OneDrive
   Set-SPOUser -Site "https://contoso-my.sharepoint.com/personal/victim_contoso_com" -LoginName "attacker@external.com" -IsSiteCollectionAdmin $false

3. Reconcile FileSyncDownloadedFull Manifest: Export all FileSyncDownloadedFull events associated with unauthorized IP addresses to generate the definitive exfiltration spreadsheet required by legal and regulatory counsel.

4. Enforce Conditional Access Device Compliance for Sync: Harden the tenant against future sync exfiltration by requiring hybrid Entra join or compliant Intune devices for the OneDrive Sync Client (App ID: ab9b8c07-8f02-4572-86fa-10992910f3c3).

---

7. Related Intelligence & Cross-References

32. Microsoft 365 Data Attack Surface Mapping Understand tenant data exposure vectors and the evidentiary threshold ladder.

34. SharePoint Online Forensics Explore site collection architecture and file preview vs download forensics.

36. Microsoft Teams Forensics Understand how 1:1 chat files are stored directly in user OneDrive drives.

37. Data Access Paths & Blast Radius Synthesize OneDrive sync telemetry into an authoritative regulatory disclosure report.