Microsoft Sync Center Outbound Connection to Non-Private IP
Detects suspicious outbound network connections initiated by Microsoft Sync Center (mobsync.exe) to non-private IP addresses. This activity is unusual for mobsync.exe, which typically handles offline file synchronization and should primarily communicate with internal network resources or specific cloud services, not arbitrary external IPs. Such connections could indicate compromise or malicious use of a legitimate system binary.
Sigma
