Emerging Threathightest

APT40 Dropbox Tool User Agent

Detects suspicious user agent string of APT40 Dropbox tool

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Thomas PatzkeCreated Tue Nov 12Updated Thu May 185ba715b6-71b7-44fd-8245-f66893e81b3d2019

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection:
        c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36'
        cs-host: 'api.dropbox.com'
    condition: selection

False Positives

Old browsers

References

Resolving title…

Internal research from Florian Roth

MITRE ATT&CK

Tactics

TA0011 · Command and Control TA0010 · Exfiltration

Sub-techniques

T1071.001 · Web Protocols T1567.002 · Exfiltration to Cloud Storage

Other

detection.emerging-threats

Rule Metadata

Rule ID

5ba715b6-71b7-44fd-8245-f66893e81b3d

Status

test

Level

high

Type

Emerging Threat

Created

Tue Nov 12

Modified

Thu May 18

Author

Thomas Patzke

Path

rules-emerging-threats/2019/TA/APT40/proxy_apt_apt40_dropbox_tool_ua.yml

Raw Tags

attack.command-and-controlattack.t1071.001attack.exfiltrationattack.t1567.002detection.emerging-threats

View on GitHub