Microsoft Sync Center (mobsync.exe) network connections to non-private IPs

title: Microsoft Sync Center (mobsync.exe) network connections to non-private IPs
id: b79363de-d727-47d6-b0ed-3d47f8718200
status: test
description: This rule flags network connections initiated by Microsoft Sync Center’s mobsync.exe when the destination IP is not within common local/private ranges (including IPv4 private blocks and select IPv6 local/private ranges). Such outbound connections can indicate abuse of a legitimate Windows component to perform stealthy network activity. It relies on Windows network connection telemetry that includes the connecting process image path and the destination IP address.
references:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml
author: elhoim, Huntrule Team
date: 2022-04-28
modified: 2024-03-12
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - attack.t1218
  - attack.execution
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    Image|endswith: \mobsync.exe
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b
    type: derived