Windows Suspicious Dropbox API Network Connections from Non-Dropbox Executables

title: Windows Suspicious Dropbox API Network Connections from Non-Dropbox Executables
id: 5d2faec3-41b8-4cab-92b6-2f9d25815ec9
status: test
description: This rule flags Windows network connections initiated by an executable that is not Dropbox itself, when the destination host is an established Dropbox API endpoint (api.dropboxapi.com or content.dropboxapi.com). Attackers commonly abuse cloud storage APIs to blend exfiltration or command-and-control traffic into legitimate third-party services. The detection relies on network connection telemetry (initiated sessions and destination hostnames) and process path context by excluding executables whose image path contains the Dropbox directory string.
references:
  - https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb
  - https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_dropbox_api.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-20
tags:
  - attack.command-and-control
  - attack.exfiltration
  - attack.t1105
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith:
      - api.dropboxapi.com
      - content.dropboxapi.com
  filter_main_legit_dropbox:
    Image|contains: \Dropbox
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate use of the API with a tool that the author wasn't aware of
level: high
license: DRL-1.1
related:
  - id: 25eabf56-22f0-4915-a1ed-056b8dae0a68
    type: derived