{"id":"25eabf56-22f0-4915-a1ed-056b8dae0a68","title":"Suspicious Dropbox API Usage","description":"Detects an executable that isn't dropbox but communicates with the Dropbox API","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-20","modified":"","tags":["attack.command-and-control","attack.exfiltration","attack.t1105","attack.t1567.002"],"technique_ids":["T1105","T1567.002"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Legitimate use of the API with a tool that the author wasn't aware of"],"references":["https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb","https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east"],"source_path":"rules/windows/network_connection/net_connection_win_domain_dropbox_api.yml","source_sha256":"8cd27f9c99c20fb10bf79106721856999d27a6fae6768cc743ea6017490339f9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_dropbox_api.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Dropbox API Usage\nid: 25eabf56-22f0-4915-a1ed-056b8dae0a68\nstatus: test\ndescription: Detects an executable that isn't dropbox but communicates with the Dropbox API\nreferences:\n    - https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb\n    - https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-04-20\ntags:\n    - attack.command-and-control\n    - attack.exfiltration\n    - attack.t1105\n    - attack.t1567.002\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        Initiated: 'true'\n        DestinationHostname|endswith:\n            - 'api.dropboxapi.com'\n            - 'content.dropboxapi.com'\n    filter_main_legit_dropbox:\n        # Note: It's better to add a specific path to the exact location(s) where dropbox is installed\n        Image|contains: '\\Dropbox'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate use of the API with a tool that the author wasn't aware of\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1567.002","id":"T1567.002","name":"Exfiltration to Cloud Storage","page":"techniques/enterprise/T1567.002/"}],"data_path":"data/detection-rules/25eabf56-22f0-4915-a1ed-056b8dae0a68.json","kind":"sigma"}