payload:
# OneDrive
- PROCESS-NAME,OneDrive
- DOMAIN-SUFFIX,1drv.com
- DOMAIN-SUFFIX,onedrive.com
- DOMAIN-SUFFIX,storage.live.com
- DOMAIN,oneclient.sfx.ms