Agent Foskett Investigation • OneDrive • Microsoft 365 • Cloud Activity • KQL
The User Didn't Upload the File — OneDrive Did It Automatically
A sensitive file appeared in OneDrive.
The audit trail showed cloud activity.
The user was the obvious person to ask.
“I didn't upload it.”
That sounded impossible.
Until Agent Foskett stopped treating the file reached OneDrive and the user manually uploaded the file as the same statement.
Cloud Activity Does Not Always Describe Human Intent
A file appearing in a cloud service proves an event occurred. It does not, by itself, prove the user deliberately opened a browser and uploaded it.
✓ Establish when the file appeared in the cloud
✓ Compare cloud activity with endpoint file activity
✓ Separate synchronisation from deliberate user action
The allegation sounded simple
A file that should have remained local appeared in the user's OneDrive. The first explanation was equally simple: the user uploaded it. Agent Foskett wanted evidence for the verb uploaded, not just evidence that the file existed in the cloud.
The file existed locallyThat established a possible source, but not the transfer mechanism.
The file appeared in OneDriveThat established cloud activity, but not whether it was deliberate.
The user denied uploading itThe statement became something to test against the timeline rather than accept or reject on instinct.
Start with the cloud event
In Microsoft Defender XDR, CloudAppEvents can help establish cloud application activity. Exact action names and available fields depend on the connected workload and telemetry, so the first query should inspect the records rather than assume one event label tells the whole story.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
CloudAppEvents
| where Timestamp > ago(7d)
| where ObjectName has "Quarterly-Financials.xlsx"
| project Timestamp, ActionType, Application,
AccountDisplayName, AccountId, IPAddress,
ObjectName, ObjectType, RawEventData
| order by Timestamp asc
Investigation point: the cloud record establishes what the service observed. Do not automatically translate that into a statement about what the person intended to do.
Now go back to the device
The next question is what happened to the same filename on the endpoint. DeviceFileEvents can help build the local timeline and show file creation, modification, rename or movement activity where that telemetry is available.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName =~ "Quarterly-Financials.xlsx"
| project Timestamp, DeviceName, ActionType,
FolderPath, FileName, SHA256,
InitiatingProcessFileName,
InitiatingProcessAccountName
| order by Timestamp asc
The path changed the investigation
Suppose the endpoint timeline places the file inside a folder already configured for OneDrive synchronisation. That changes the hypothesis. A user can save, copy or move a file locally and the OneDrive sync client can subsequently transfer it to the cloud without the user performing a separate browser upload.
Manual uploadA user deliberately selects a file and sends it through an upload workflow.
Synchronised folderA local file change can be detected by the sync client and replicated automatically.
Same cloud resultIn both cases the file can end up in OneDrive, but the investigation story is not the same.
Was OneDrive active at the time?
Process telemetry can add another piece to the timeline. Seeing OneDrive.exe active does not prove that a particular file was synchronised by that process, but it can support the synchronisation hypothesis when combined with the file path, timing and cloud event.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "OneDrive.exe"
| project Timestamp, DeviceName, FileName,
ProcessCommandLine, AccountName,
InitiatingProcessFileName
| order by Timestamp asc
Correlation is where the story appears
No single row needs to carry the whole case. Agent Foskett lines up the local file event, the location of the synchronised folder, OneDrive process activity and the cloud event. The sequence matters more than any one field.
09:41The file is written or moved into a locally synchronised OneDrive path.
09:41–09:42OneDrive is active on the device.
09:42The corresponding object activity appears in the cloud telemetry.
LaterThe user is accused of manually uploading the file.
What can the evidence actually prove?
ProvenThe file existed locally and subsequently appeared in the cloud.
SupportedThe timing and endpoint context may support automatic OneDrive synchronisation as the transfer mechanism.
Not automatically provenThat the user deliberately selected the file and manually uploaded it.
Important: telemetry varies by licensing, workload, connector and retention. Treat the example fields as an investigation pattern and validate the records available in your own tenant.
Agent Foskett's investigation mindset
The dangerous word in the original allegation was not file. It was uploaded. That word described a human action the evidence had not yet established.
Describe the event first“The file appeared in OneDrive” is evidence-based and neutral.
Then establish mechanismBrowser upload, sync client, application, automation and API activity are different investigative paths.
Then discuss intentDo not infer deliberate user behaviour simply because a cloud object exists.
Investigation findings
The user's statement“I didn't upload it” was not contradicted merely because the file existed in OneDrive.
The timelineEndpoint and cloud evidence can reveal whether the file entered a synchronised path before appearing online.
The lessonA cloud event records activity. The investigator still has to establish the mechanism behind it.
Related investigations
Continue following the evidence across Microsoft 365, SharePoint and cloud activity investigations.
The File Was Never Downloaded — It Was SynchronisedAnother case where the transfer mechanism changed the interpretation.The Attacker Didn't Download the Files — They Shared ThemFollow cloud actions without assuming traditional exfiltration.The SharePoint File Was Deleted — But the Audit Trail Still Had the EvidenceUse audit evidence when the object itself is gone.
Final thought
The user said they did not upload the file. The cloud said the file arrived. Both statements could be true. The missing piece was the mechanism between them. Agent Foskett followed the timeline and found the question had been phrased incorrectly from the beginning. The file reached OneDrive — but that did not automatically mean somebody clicked Upload. 🔎
File in OneDrive?Establish the cloud event.
User denies uploading?Check the local path, sync context and timeline.
The lesson?Do not confuse an outcome with the action that produced it.
