OneDrive
Named by 6 kept items in this workspace.
Search every workspace for OneDrive. It matches the name as written, so it can find other things that share it.
The items that name it 6
Listed among Copilot's connected apps accessible during the attack
Accessed via OctoLink Live using stolen tokens/cookies
used for exfiltration
scanned via SharePoint backing; unsynced OneDrive files are dodged by Sift
All technologies in this workspace.