Detecting Abuse Of Sync Thing Tool To Steal Data
Query
DeviceNetworkEvents
| extend geo_info = tostring(geo_info_from_ip_address(RemoteIP).country)
| where InitiatingProcessCommandLine has "syncthing.exe --no-browser"
| summarize by DeviceName,LocalIP, RemoteIP,geo_info, InitiatingProcessVersionInfoProductName, InitiatingProcessCommandLine, ActionTypeAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1567 | Exfiltration Over Web Service |
Author: Sergio Albea (06/11/2025)
Detecting abuse of SyncThing tool to steal data
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1071.002 | Application Layer Protocol: File Transfer Protocols |
| Author | Sergio Albea (06/11/2025) |
|---|
Description: Syncthing is a peer-to-peer file synchronization utility, designed to sync files between devices on a local network or between remote devices over the Internet. This utility to exfiltrate data, has been already abused to exfiltrate data by Malicious actor. The following KQL Query detect connections to external IPs via the mentioned software and the corresponding country.
Explanation
This query is designed to detect potential misuse of the Syncthing tool for data exfiltration. Syncthing is a software used for synchronizing files between devices, but it can be exploited by malicious actors to transfer data to unauthorized locations.
Here's a simple breakdown of what the query does:
-
Data Source: It analyzes network events from devices.
-
Geo-Location: It extends the data to include the country information of the remote IP address involved in the connection.
-
Filter Criteria: It specifically looks for instances where the Syncthing application is running with the command line option
--no-browser, which might indicate a non-standard or suspicious use. -
Summarization: The query summarizes the results by listing:
- Device name
- Local IP address
- Remote IP address
- Country of the remote IP
- Product name of the initiating process
- Command line used to initiate the process
- Type of action performed
This helps in identifying and investigating any unusual or unauthorized data transfers using Syncthing, particularly those involving external IP addresses.
