Vendor: Dropbox

April 15, 2026 · View on GitHub

Product: Dropbox

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
20397411113
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessapp-activity
dropbox-d-cef-vpnfileapp-8
dropbox-d-cef-vpnfileapp-7
dropbox-d-cef-vpnfileapp-6
dropbox-d-cef-vpnfileapp-5
dropbox-d-cef-vpnfileapp-4
dropbox-d-json-app-file-success-tag
dropbox-d-json-app-activity-success-shared
dropbox-d-cef-vpnfileapp-3
dropbox-d-cef-vpnfileapp-2
dropbox-d-cef-vpnfileapp-8
dropbox-d-cef-vpnfileapp-7
dropbox-d-cef-vpnfileapp-6
dropbox-d-cef-vpnfileapp-5
dropbox-d-cef-vpnfileapp-4
dropbox-d-json-app-file-success-tag
dropbox-d-json-app-activity-success-shared
dropbox-d-cef-vpnfileapp-3
dropbox-d-cef-vpnfileapp-2
dropbox-d-cef-app-activity-success-catchall

app-login
dropbox-d-cef-vpnfileapp-8
dropbox-d-cef-vpnfileapp-7
dropbox-d-cef-vpnfileapp-6
dropbox-d-cef-vpnfileapp-5
dropbox-d-cef-vpnfileapp-4
dropbox-d-json-app-file-success-tag
dropbox-d-json-app-activity-success-shared
dropbox-d-cef-vpnfileapp-3
dropbox-d-cef-vpnfileapp-2
dropbox-d-json-app-login-success-login

member-added
dropbox-d-cef-group-member-add-remove-success-group

member-removed
dropbox-d-cef-group-member-add-remove-success-group

vpn-logout
dropbox-d-cef-vpnfileapp-8
dropbox-d-cef-vpnfileapp-7
dropbox-d-cef-vpnfileapp-6
dropbox-d-cef-vpnfileapp-5
dropbox-d-cef-vpnfileapp-4
dropbox-d-json-app-file-success-tag
dropbox-d-json-app-activity-success-shared
dropbox-d-cef-vpnfileapp-3
dropbox-d-cef-vpnfileapp-2
T1021 - Remote Services
T1078 - Valid Accounts
T1133 - External Remote Services
  • 25 Rules
  • 6 Models
Account Manipulationapp-activity
dropbox-d-cef-vpnfileapp-8
dropbox-d-cef-vpnfileapp-7
dropbox-d-cef-vpnfileapp-6
dropbox-d-cef-vpnfileapp-5
dropbox-d-cef-vpnfileapp-4
dropbox-d-json-app-file-success-tag
dropbox-d-json-app-activity-success-shared
dropbox-d-cef-vpnfileapp-3
dropbox-d-cef-vpnfileapp-2
dropbox-d-cef-vpnfileapp-8
dropbox-d-cef-vpnfileapp-7
dropbox-d-cef-vpnfileapp-6
dropbox-d-cef-vpnfileapp-5
dropbox-d-cef-vpnfileapp-4
dropbox-d-json-app-file-success-tag
dropbox-d-json-app-activity-success-shared
dropbox-d-cef-vpnfileapp-3
dropbox-d-cef-vpnfileapp-2
dropbox-d-cef-app-activity-success-catchall

member-added
dropbox-d-cef-group-member-add-remove-success-group

member-removed
dropbox-d-cef-group-member-add-remove-success-group

vpn-logout
dropbox-d-cef-vpnfileapp-8
dropbox-d-cef-vpnfileapp-7
dropbox-d-cef-vpnfileapp-6
dropbox-d-cef-vpnfileapp-5
dropbox-d-cef-vpnfileapp-4
dropbox-d-json-app-file-success-tag
dropbox-d-json-app-activity-success-shared
dropbox-d-cef-vpnfileapp-3
dropbox-d-cef-vpnfileapp-2
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
T1484 - Group Policy Modification
  • 34 Rules
  • 19 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

Phishing

Create Account

External Remote Services

Valid Accounts

Server Software Component: Web Shell

Account Manipulation

Server Software Component

Boot or Logon Autostart Execution

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Exploitation for Privilege Escalation

Group Policy Modification

Boot or Logon Autostart Execution

Group Policy Modification

Obfuscated Files or Information: Indicator Removal from Tools

Indicator Removal on Host: File Deletion

Valid Accounts

Indicator Removal on Host

Obfuscated Files or Information

OS Credential Dumping

Brute Force

Steal or Forge Kerberos Tickets

Credentials from Password Stores

Steal or Forge Kerberos Tickets: Kerberoasting

File and Directory Discovery

Remote Services

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy

Exfiltration Over Alternative Protocol

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Exfiltration Over Physical Medium: Exfiltration over USB

Exfiltration Over Physical Medium

Data Destruction

Data Encrypted for Impact