Sigma rule: Suspicious Dropbox API Usage

Rule

Title

Suspicious Dropbox API Usage

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2022-04-20

File

rules/windows/network_connection/net_connection_win_domain_dropbox_api.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects an executable that isn't dropbox but communicates with the Dropbox API

Log source

product

windows

category

network_connection

Detection

selection:
    Initiated: 'true'
    DestinationHostname|endswith:
        - 'api.dropboxapi.com'
        - 'content.dropboxapi.com'
filter_main_legit_dropbox:
    # Note: It's better to add a specific path to the exact location(s) where dropbox is installed
    Image|contains: '\Dropbox'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate use of the API with a tool that the author wasn't aware of

Tags

• attack.command-and-control
• attack.exfiltration
• attack.t1105
• attack.t1567.002

MITRE ATT&CK ids this rule names

• T1105
• T1567.002

References

• https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb
• https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/network_connection/net_connection_win_domain_dropbox_api.yml