Bart

Ah sorry I mistook you for someone who works on the red/blue penetration teams and filing a bug falls under their responsibilities ;-)

Oh no. Don't worry. I will absolutely file your most awesome of bug reports. They might not be able to repro though...

"Not a reproducible bug". 2 years later: "exclusive MS threat intel actor seen using <the bug> previously shown at <con name>" ;-)

In seriousness, you know you can DM me details. I think you know me well enough to know that I would connect with the right people.

Oh, I thought onedrive's behavior was a matter of public knowledge/ridicule

It loads DLLs from local appdata (no load order mitigation or sane settings) and is a default ASEP that is extremely hard to disable on w10

So drop one of the three DLLs in the right user RW obscure directory and you get free built-in persistence without much obviousness

Thank you kindly, sir. While I can't possibly know everything, I now know more and will find out who I can reach out to.