title: Suspicious Dropbox API Usage
id: 25eabf56-22f0-4915-a1ed-056b8dae0a68
status: experimental
description: Detects an executable that isn't dropbox but communicates with the Dropbox API
author: Florian Roth
references:
  - https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb
  - https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east
date: 2022/04/20
logsource:
   category: network_connection
   product: windows
detection:
   selection:
      Initiated: 'true'
      DestinationHostname|endswith: 
         - 'api.dropboxapi.com'
         - 'content.dropboxapi.com'
   filter:
      Image|contains: '\Dropbox'
   condition: selection and not filter
falsepositives:
   - Legitimate use of the API with a tool that the author wasn't aware of
level: high
