Suspicious Dropbox API Usage by Non-Dropbox Process

SigmaHQ Detections@sigmaHQ

•updated Jul 30, 2025•0•30

This rule detects suspicious network connections to Dropbox API endpoints (api.dropboxapi.com or content.dropboxapi.com) originating from any executable that is not the legitimate Dropbox application. This behavior can indicate an adversary using a non-standard or malicious process to exfiltrate data or establish command and control via Dropbox.