Created Files by Microsoft Sync Center

Title: Created Files by Microsoft Sync Center
Status: test
Description:This rule detects suspicious files created by Microsoft Sync Center (mobsync)
References:
  -https://redcanary.com/blog/intelligence-insights-november-2021/
Author: elhoim
Date: 2022-04-28
modified:2022-06-02
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'
• -'attack.t1218'
• -'attack.execution'

Logsource:

• product: windows
• category: file_event

Detection:
  selection_mobsync:
    Image|endswith: '\mobsync.exe'
  filter_created_file:
    TargetFilename|endswith:
      -'.dll'
      -'.exe'

  condition:selection_mobsync and filter_created_file
Falsepositives:
  -Unknown
Level: medium