2_ds_dropbox_dropbox.md

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Brute Force Attack	vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1110 - Brute Force	1 Rules 1 Models
Compromised Credentials	app-activity ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-app-activity-success-catchall app-login ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-json-app-login-success-login file-delete ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-permission-change ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-read ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-read-success-filerequest file-write ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-write-success-comment security-alert ↳dropbox-d-cef-alert-trigger-success-alert vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1083 - File and Directory Discovery T1110 - Brute Force T1133 - External Remote Services T1190 - Exploit Public Fasing Application	109 Rules 51 Models
Data Access	app-activity ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-app-activity-success-catchall app-login ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-json-app-login-success-login file-delete ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-permission-change ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-read ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-read-success-filerequest file-write ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-write-success-comment vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1078 - Valid Accounts T1083 - File and Directory Discovery T1110 - Brute Force	44 Rules 25 Models
Data Exfiltration	file-write ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-write-success-comment vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1133 - External Remote Services TA0002 - TA0002 TA0010 - TA0010	6 Rules 5 Models
Data Leak	app-activity ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-app-activity-success-catchall file-write ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-write-success-comment vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114 - Email Collection T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule T1133 - External Remote Services TA0010 - TA0010	15 Rules 11 Models
Destruction of Data	file-delete ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1070 - Indicator Removal on Host T1070.004 - Indicator Removal on Host: File Deletion T1485 - Data Destruction	1 Rules
Lateral Movement	app-login ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-json-app-login-success-login security-alert ↳dropbox-d-cef-alert-trigger-success-alert vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1090 - Proxy T1090.003 - Proxy: Multi-hop Proxy T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting	10 Rules 3 Models
Malware	app-login ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-json-app-login-success-login file-write ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-write-success-comment security-alert ↳dropbox-d-cef-alert-trigger-success-alert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1078 - Valid Accounts T1505 - Server Software Component T1505.003 - Server Software Component: Web Shell T1547 - Boot or Logon Autostart Execution T1547.001 - T1547.001 TA0002 - TA0002	13 Rules 5 Models
Phishing	vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1566 - Phishing	2 Rules 2 Models
Privilege Abuse	app-activity ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-app-activity-success-catchall app-login ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-json-app-login-success-login file-delete ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-download ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-permission-change ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-read ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-read-success-filerequest file-write ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-write-success-comment member-added ↳dropbox-d-cef-group-member-add-remove-success-group member-removed ↳dropbox-d-cef-group-member-add-remove-success-group vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account	33 Rules 15 Models
Privilege Escalation	app-activity ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-app-activity-success-catchall vpn-logout ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1555 - Credentials from Password Stores T1555.005 - T1555.005	8 Rules 5 Models
Privileged Activity	app-activity ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-app-activity-success-catchall app-login ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-json-app-login-success-login file-delete ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-download ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-permission-change ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 file-read ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-read-success-filerequest file-write ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-write-success-comment security-alert ↳dropbox-d-cef-alert-trigger-success-alert	T1068 - Exploitation for Privilege Escalation T1078 - Valid Accounts	4 Rules 1 Models
Ransomware	app-login ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-json-app-login-success-login file-write ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-vpnfileapp-8 ↳dropbox-d-cef-vpnfileapp-7 ↳dropbox-d-cef-vpnfileapp-6 ↳dropbox-d-cef-vpnfileapp-5 ↳dropbox-d-cef-vpnfileapp-4 ↳dropbox-d-json-app-file-success-tag ↳dropbox-d-json-app-activity-success-shared ↳dropbox-d-cef-vpnfileapp-3 ↳dropbox-d-cef-vpnfileapp-2 ↳dropbox-d-cef-file-write-success-comment	T1078 - Valid Accounts T1486 - Data Encrypted for Impact	2 Rules