ATT&CK T1567 - Exfiltration to Cloud Storage: Dropbox

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 5000 bytes, indicating a significant upload.