APT40 Dropbox Tool User Agent Detection

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•0•54

Detects a specific user agent string and host ('api.dropbox.com') associated with an APT40 Dropbox tool, indicating potential data exfiltration or command and control activity via Dropbox.