Dropbox API exfiltration with victim-identifying folder path (_lns)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•1

Detects anomalous data exfiltration activity to Dropbox API, specifically utilizing a naming convention in the file path ('_lns/') often associated with Kimsuky threat actor tools. The rule monitors HTTP POST requests to content.dropboxapi.com with characteristic 'Dropbox-API-Arg' header values and TLS SNI indicators.