Proxy User-Agent Matching APT40 Dropbox Tool on api.dropbox.com

Alerts on proxy requests using a fixed Chrome 36 user-agent to api.dropbox.com.

FreeReviewedSigma · High · v5

Category: proxy
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2019-11-12
Updated: 2026-07-31

ATT&CK techniques

C2 → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
- T1567.002Exfiltration to Cloud Storage
Impact

What it detects

This rule flags proxy traffic where the User-Agent exactly matches a specific Windows/Chrome 36 string while the destination host is api.dropbox.com. Such mismatched or overly specific tool-like User-Agents can indicate command-and-control or data-exfiltration activity disguised as legitimate Dropbox access. It relies on proxy telemetry capturing destination host and the full client User-Agent string.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious Encrypted Reverse Shell via Netcat and GPG on Linux

Malicious axios NPM Supply Chain C2 Domain Resolution

Suspicious Reverse Shell via Dev TCP or Netcat

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Proxy User-Agent Matching APT40 Dropbox Tool on api.dropbox.com

Pivot detection · T1071.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-detection-suspicious-chrome-36-user-agent-to-api-dropbox-com-5ba715b6

title: Proxy User-Agent Matching APT40 Dropbox Tool on api.dropbox.com
id: 2c3d8655-9efe-4dcd-946a-ccfbf6506895
status: test
description: This rule flags proxy traffic where the User-Agent exactly matches a specific Windows/Chrome 36 string while the destination host is api.dropbox.com. Such mismatched or overly specific tool-like User-Agents can indicate command-and-control or data-exfiltration activity disguised as legitimate Dropbox access. It relies on proxy telemetry capturing destination host and the full client User-Agent string.
references:
  - Internal research from Florian Roth
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APT40/proxy_apt_apt40_dropbox_tool_ua.yml
author: Thomas Patzke, Huntrule Team
date: 2019-11-12
modified: 2023-05-18
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1567.002
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36
    cs-host: api.dropbox.com
  condition: selection
falsepositives:
  - Old browsers
level: high
license: DRL-1.1
related:
  - id: 5ba715b6-71b7-44fd-8245-f66893e81b3d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL