Proxy Detection: Suspicious Chrome 36 User-Agent to api.dropbox.com

title: "Proxy Detection: Suspicious Chrome 36 User-Agent to api.dropbox.com"
id: 2c3d8655-9efe-4dcd-946a-ccfbf6506895
status: test
description: This rule flags proxy traffic where the request user-agent exactly matches a specific Chrome 36 string and the destination host is api.dropbox.com. Attackers may blend exfiltration or command-and-control traffic into legitimate cloud service requests by using consistent, non-browser-specific client identifiers. The detection relies on proxy logs containing the client user-agent and the requested host/domain.
references:
  - Internal research from Florian Roth
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APT40/proxy_apt_apt40_dropbox_tool_ua.yml
author: Thomas Patzke, Huntrule Team
date: 2019-11-12
modified: 2023-05-18
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1567.002
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36
    cs-host: api.dropbox.com
  condition: selection
falsepositives:
  - Old browsers
level: high
license: DRL-1.1
related:
  - id: 5ba715b6-71b7-44fd-8245-f66893e81b3d
    type: derived