Suspicious Executable File Creation by Microsoft Sync Center
This rule detects the creation of suspicious executable files (.dll or .exe) by Microsoft Sync Center (mobsync.exe). While mobsync.exe is a legitimate Windows process for synchronizing offline files, its use to create executable files can be indicative of malicious activity, such as persistence, defense evasion, or privilege escalation, where an attacker might be attempting to drop and execute malicious payloads using a trusted system binary.
Sigma
