huntrule

Windows: Files Created by Microsoft Sync Center (mobsync.exe)

Flags .dll and .exe files created by mobsync.exe on Windows.

FreeUnreviewedSigmamediumv1
title: "Windows: Files Created by Microsoft Sync Center (mobsync.exe)"
id: d7dc7168-d016-4dba-929d-0ead09792cca
status: test
description: This rule identifies file creation events where Microsoft Sync Center (mobsync.exe) creates files with .dll or .exe extensions. Attackers can use legitimate Windows utilities to blend in with normal activity while dropping executable payloads. The detection relies on Windows file event telemetry that provides the creating process image path and the target filename.
references:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml
author: elhoim, Huntrule Team
date: 2022-04-28
modified: 2022-06-02
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - attack.t1218
  - attack.execution
logsource:
  product: windows
  category: file_event
detection:
  selection_mobsync:
    Image|endswith: \mobsync.exe
  filter_created_file:
    TargetFilename|endswith:
      - .dll
      - .exe
  condition: selection_mobsync and filter_created_file
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 409f8a98-4496-4aaa-818a-c931c0a8b832
    type: derived

What it detects

This rule identifies file creation events where Microsoft Sync Center (mobsync.exe) creates files with .dll or .exe extensions. Attackers can use legitimate Windows utilities to blend in with normal activity while dropping executable payloads. The detection relies on Windows file event telemetry that provides the creating process image path and the target filename.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.