Detection rules › Sigma
Microsoft Sync Center Suspicious Network Connections
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | |
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 3: Network connection |
Rule body
title: Microsoft Sync Center Suspicious Network Connections
id: 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b
status: test
description: Detects suspicious connections from Microsoft Sync Center to non-private IPs.
references:
- https://redcanary.com/blog/intelligence-insights-november-2021/
author: elhoim
date: 2022-04-28
modified: 2024-03-12
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055
- attack.t1218
- attack.execution
logsource:
product: windows
category: network_connection
detection:
selection:
Image|endswith: '\mobsync.exe'
filter_main_local_ranges:
DestinationIp|cidr:
- '127.0.0.0/8'
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '169.254.0.0/16'
- '::1/128' # IPv6 loopback
- 'fe80::/10' # IPv6 link-local addresses
- 'fc00::/7' # IPv6 private addresses
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
Image|endswith: '\mobsync.exe'
Stage 2: not filter_main_local_ranges
filter_main_local_ranges:
DestinationIp|cidr:
- '127.0.0.0/8'
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '169.254.0.0/16'
- '::1/128'
- 'fe80::/10'
- 'fc00::/7'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
DestinationIp | cidr_match | 10.0.0.0/8 | excludes:DestinationIp field:"DestinationIp" value:"10.0.0.0/8" |
DestinationIp | cidr_match | 127.0.0.0/8 | excludes:DestinationIp field:"DestinationIp" value:"127.0.0.0/8" |
DestinationIp | cidr_match | 169.254.0.0/16 | excludes:DestinationIp field:"DestinationIp" value:"169.254.0.0/16" |
DestinationIp | cidr_match | 172.16.0.0/12 | excludes:DestinationIp field:"DestinationIp" value:"172.16.0.0/12" |
DestinationIp | cidr_match | 192.168.0.0/16 | excludes:DestinationIp field:"DestinationIp" value:"192.168.0.0/16" |
DestinationIp | cidr_match | ::1/128 | excludes:DestinationIp field:"DestinationIp" value:"::1/128" |
DestinationIp | cidr_match | fc00::/7 | excludes:DestinationIp field:"DestinationIp" value:"fc00::/7" |
DestinationIp | cidr_match | fe80::/10 | excludes:DestinationIp field:"DestinationIp" value:"fe80::/10" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with value:"\mobsync.exe" |