Gamaredon PowerShell Dropbox Dead-Drop C2 Address Retrieval

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•6

This rule detects the execution of common scripting interpreters (powershell.exe, wscript.exe, cscript.exe, mshta.exe) where the command line arguments contain domains associated with the Dropbox API. This behavior is indicative of potential data exfiltration or the downloading of malicious payloads via a legitimate cloud storage service, a common technique for bypassing network filters and security controls.