Vendor: Dropbox

July 25, 2023 · View on GitHub

Product: Dropbox

Rules	Models	MITRE TTPs	Event Types	Parsers
91	53	19	8	8

Use-Case	Event Types/Parsers	MITRE TTP	Content
Account Manipulation	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 4 Models
Brute Force Attack	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1003 - OS Credential Dumping	4 Rules 4 Models
Compromised Credentials	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1110 - Brute Force T1133 - External Remote Services	52 Rules 29 Models
Data Access	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1078 - Valid Accounts T1083 - File and Directory Discovery T1110 - Brute Force	31 Rules 20 Models
Data Exfiltration	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1204 - User Execution	2 Rules 1 Models
Data Leak	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114.003 - Email Collection: Email Forwarding Rule	8 Rules 6 Models
Evasion	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1090.003 - Proxy: Multi-hop Proxy	1 Rules
Lateral Movement	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1078 - Valid Accounts T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting	3 Rules 2 Models
Malware	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	7 Rules 2 Models
Phishing	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1566 - Phishing	2 Rules 2 Models
Privilege Abuse	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1078 - Valid Accounts T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 1 Models
Privilege Escalation	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1003 - OS Credential Dumping T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	8 Rules 5 Models
Privileged Activity	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1078 - Valid Accounts T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 3 Models
Ransomware	app-activity ↳ s-dropbox-app-activity-2 ↳ s-dropbox-app-activity-1 ↳ cef-dropbox-app-activity-1 app-login ↳ s-dropbox-devices-activity ↳ cef-dropbox-app-activity-1 file-delete ↳ cef-dropbox-app-activity-1 file-download ↳ cef-dropbox-app-activity-1 file-permission-change ↳ cef-dropbox-app-activity-1 file-read ↳ cef-dropbox-app-activity-1 file-write ↳ cef-dropbox-app-activity-1 vpn-logout ↳ cef-dropbox-app-activity-1	T1078 - Valid Accounts	1 Rules

ATT&CK Matrix for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
External Remote Services Valid Accounts Phishing	User Execution	External Remote Services Valid Accounts Account Manipulation Account Manipulation: Exchange Email Delegate Permissions	Valid Accounts	Signed Binary Proxy Execution: Rundll32 Valid Accounts Obfuscated Files or Information	OS Credential Dumping Brute Force Steal or Forge Kerberos Tickets Steal or Forge Kerberos Tickets: Kerberoasting	File and Directory Discovery		Email Collection Email Collection: Email Forwarding Rule	Proxy: Multi-hop Proxy Proxy	Exfiltration Over Alternative Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration Over Physical Medium: Exfiltration over USB Exfiltration Over Physical Medium