DropBox - Massive File Downloads

This rule detects more than 100 downloaded files during an hour by the same user. This is a suspicious behavior which can be an indication of a data exfiltration.

Dropbox MEDIUM EXFILTRATION

Details

ID	`205317b6-c494-4836-ac31-f80c8204cf4e`
From Version	6.10.0
Execution Mode	SCHEDULED
Crontab	`0 * * * *`
Search Window	4 hours
Dataset	alerts

MITRE ATT&CK

TA0010 - Exfiltration
- T1567 - Exfiltration Over Web Service

XQL Query

datamodel dataset = dropbox_dropbox_raw
| filter xdm.event.type = "file_operations" and xdm.event.operation_sub_type = "file_download"
| alter user = coalesce(xdm.source.user.username, xdm.target.user.username)
| comp values(xdm.source.ipv4) as SourceIP, values(xdm.source.location.country) as Countries, max(_time) as lastTime, values(xdm.target.resource.name) as Files, count() as NumberOfFiles by user
| filter NumberOfFiles > 100

Investigation Query

datamodel dataset = dropbox_dropbox_raw
| filter xdm.event.type = "file_operations" and xdm.event.operation_sub_type = "file_download"
| alter user = coalesce(xdm.source.user.username, xdm.target.user.username)
| filter user = $user