Microsoft Sync Center Suspicious Network Connections

Title: Microsoft Sync Center Suspicious Network Connections
Status: test
Description:Detects suspicious connections from Microsoft Sync Center to non-private IPs.
References:
  -https://redcanary.com/blog/intelligence-insights-november-2021/
Author: elhoim
Date: 2022-04-28
modified:2024-03-12
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'
• -'attack.t1218'
• -'attack.execution'

Logsource:

• product: windows
• category: network_connection

Detection:
  selection:
    Image|endswith: '\mobsync.exe'
  filter_main_local_ranges:
    DestinationIp|cidr:
      -'127.0.0.0/8'
      -'10.0.0.0/8'
      -'172.16.0.0/12'
      -'192.168.0.0/16'
      -'169.254.0.0/16'
      -'::1/128'
      -'fe80::/10'
      -'fc00::/7'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium