[EX] - Detecting abuse of SyncThing tool to steal data
Syncthing is a peer-to-peer file synchronization utility, designed to sync files between devices on a local network or between remote devices over the Internet. This utility to exfiltrate data, has been already abused to exfiltrate data by Malicious actor. The following KQL Query detect connections to external IPs via the mentioned software and the corresponding country.
Microsoft Sentinel (KQL)
