The scenario is deliberately mundane, because mundane is what you actually get:
a workstation flagged by a single Sysmon alert, a user who "didn't install
anything", and a Run key value called OneDriveSync pointing at a binary that
is not OneDrive.
The interesting part is not finding the persistence. RegRipper finds it in
four seconds. The interesting part is that almost every instinct about when
it was planted turns out to be wrong.
The artifact that started it
Sysmon Event ID 13 gives you the write and the writer in one record, which is
the single best reason to deploy it:
Run key persistence: what the registry alone will not tell you · Security Artifacts
