Kimsuky exfiltration via Dropbox API upload with _lns path pattern

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•0

Detects HTTP POST requests to the Dropbox API endpoint (/2/files/upload) that appear to be unauthorized file uploads, specifically identifying patterns associated with the Kimsuky threat group. The rule triggers on both the presence of suspicious directory naming conventions (_lns/) in the Dropbox-API-Arg header and the use of hardcoded Authorization bearer tokens, both characteristic of Kimsuky's data exfiltration techniques.