This rule detects suspicious files created by Microsoft Sync Center (mobsync)
Read the full analysis on IntelFusions