rules/proxy/proxy_apt40.yml

title: APT40 Dropbox Tool User Agent
id: 5ba715b6-71b7-44fd-8245-f66893e81b3d
status: test
description: Detects suspicious user agent string of APT40 Dropbox tool
author: Thomas Patzke
references:
  - Internal research from Florian Roth
date: 2019/11/12
modified: 2021/11/27
logsource:
  category: proxy
detection:
  selection:
    c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36'
    r-dns: 'api.dropbox.com'
  condition: selection
fields:
  - c-ip
  - c-uri
falsepositives:
  - Old browsers
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1567.002
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`title: APT40 Dropbox Tool User Agent`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 5ba715b6-71b7-44fd-8245-f66893e81b3d`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`description: Detects suspicious user agent string of APT40 Dropbox tool`
Second round 2020-09-15 07:02:30 -06:00			`author: Thomas Patzke`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`references:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Internal research from Florian Roth`
fix: fixed missing date fields in proxy rules 2020-01-30 15:20:52 +01:00			`date: 2019/11/12`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: proxy`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36'`
			`r-dns: 'api.dropbox.com'`
			`condition: selection`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`fields:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- c-ip`
			`- c-uri`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Old browsers`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`level: high`
Second round 2020-09-15 07:02:30 -06:00			`tags:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- attack.command_and_control`
			`- attack.t1071.001`
			`- attack.exfiltration`
			`- attack.t1567.002`