Windows Microsoft Sync Center (mobsync.exe) Network Connections to Public IPs

Alerts when mobsync.exe makes outbound connections to destination IPs outside private/local ranges.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: elhoim (SigmaHQ), DRL 1.1
Published: 2022-04-28
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055Process Injection
Defense Evasion
- T1055Process Injection
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies outbound network connections initiated by Microsoft Sync Center’s mobsync.exe to destinations outside commonly defined local/private IP ranges. This matters because attackers may abuse legitimate Windows binaries to establish communications and blend in with normal system activity. The rule relies on Windows network connection telemetry containing the process image path and destination IP for filtering loopback, private, and link-local destinations.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Windows Image Load: coregen.exe Potential DLL Sideloading

Windows: Files created by Microsoft Sync Center (mobsync.exe) with .dll/.exe extensions

Suspicious Office Application Spawning Script Or Shell Interpreter

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious Outbound Network Connection from Explorer Process

Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)

Suspicious BugSleep Marker File in Public Directory

Windows Microsoft Sync Center (mobsync.exe) Network Connections to Public IPs

Pivot detection · T1055 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

microsoft-sync-center-mobsync-exe-network-connections-to-non-private-ips-9f2cc74d

title: Windows Microsoft Sync Center (mobsync.exe) Network Connections to Public IPs
id: b79363de-d727-47d6-b0ed-3d47f8718200
status: test
description: Identifies outbound network connections initiated by Microsoft Sync Center’s mobsync.exe to destinations outside commonly defined local/private IP ranges. This matters because attackers may abuse legitimate Windows binaries to establish communications and blend in with normal system activity. The rule relies on Windows network connection telemetry containing the process image path and destination IP for filtering loopback, private, and link-local destinations.
references:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml
author: elhoim, Huntrule Team
date: 2022-04-28
modified: 2024-03-12
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - attack.t1218
  - attack.execution
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    Image|endswith: \mobsync.exe
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL