Detection rules › Panther
Dropbox Many Downloads
Detects when a Dropbox user downloads more than 10 distinct files within 60 minutes. This may indicate data exfiltration or unauthorized bulk access to team files. The threshold should be tuned to your environment.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration | T1567 Exfiltration Over Web Service |
Rule body yaml
AnalysisType: rule
Filename: dropbox_many_downloads.py
RuleID: "Dropbox.BulkDownloads"
DisplayName: "Dropbox Many Downloads"
Status: Experimental
Enabled: false
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 11
LogTypes:
- Dropbox.TeamEvent
Description: >
Detects when a Dropbox user downloads more than 10 distinct files within 60 minutes.
This may indicate data exfiltration or unauthorized bulk access to team files.
The threshold should be tuned to your environment.
Reference: https://learn.dropbox.com/video-library/upload-and-download-files
Reports:
MITRE ATT&CK:
- TA0010:T1567
Tags:
- Dropbox
- Exfiltration
Runbook: |
1. Query Dropbox.TeamEvent for all file_download events by actor:user:email in the 2 hours around this alert to identify the full list of assets[0]:path:contextual values downloaded
2. Check involve_non_team_member and the origin:geo_location:ip_address to determine if the downloads originated from an external user or an unexpected location
3. Search for other suspicious activity by this user in the past 24 hours, including external sharing events, ownership transfers, or logins from new devices or locations
Tests:
- Name: File Downloaded
ExpectedResult: true
Log:
actor:
user:
email: alice@company.com
_tag: team_member
event_type:
_tag: file_download
assets:
- path:
contextual: /alice/report.pdf
involve_non_team_member: false
origin:
geo_location:
ip_address: 1.2.3.4
- Name: File Downloaded - Non-Team Member Involved
ExpectedResult: true
Log:
actor:
user:
email: alice@company.com
_tag: team_member
event_type:
_tag: file_download
assets:
- path:
contextual: /shared/contract.docx
involve_non_team_member: true
origin:
geo_location:
ip_address: 5.6.7.8
- Name: Non-Download Event
ExpectedResult: false
Log:
actor:
user:
email: alice@company.com
_tag: team_member
event_type:
_tag: file_view
assets:
- path:
contextual: /alice/report.pdf
involve_non_team_member: false
Detection logic
Condition
event_type._tag eq "file_download"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
event_type._tag | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
user | actor.user.email |
involve_non_team_member | |
ip_address | origin.geo_location.ip_address |