BEC - File sharing tactics - Dropbox

Description

This query helps hunting for BEC - File sharing tactics - Dropbox

Query · kql

CloudAppEvents
| where ActionType in ("Added users and/or groups to shared file/folder", "Invited user to Dropbox and added them to shared file/folder")
| where Application == "Dropbox"
| where ObjectType == "File"
| extend FileShared = tostring(ObjectName)
| where isnotempty(FileShared)
| mv-expand ActivityObjects
| where ActivityObjects.Type == "Account" and ActivityObjects.Role == "To"
| extend SharedBy = AccountId
| extend UserSharedWith = tostring(ActivityObjects.Name)
| summarize dcount(UserSharedWith) by FileShared, AccountObjectId
| where dcount_UserSharedWith >= 20
Raw source BEC - File sharing tactics - Dropbox · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 6e056084-8951-460d-93f9-525880062de9
name: BEC - File sharing tactics - Dropbox
description: |
  This query helps hunting for BEC - File sharing tactics - Dropbox
description-detailed: |
  This query helps hunting for BEC - File sharing tactics - Dropbox. 
  It highlights that highlights that a file hosted on Dropbox has been shared with multiple participants.
  Shared by Microsoft Threat Intelligence: https://www.microsoft.com/en-us/security/blog/2024/10/08/file-hosting-services-misused-for-identity-phishing/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - LateralMovement
relevantTechniques:
  - T1021
query: |
  CloudAppEvents
  | where ActionType in ("Added users and/or groups to shared file/folder", "Invited user to Dropbox and added them to shared file/folder")
  | where Application == "Dropbox"
  | where ObjectType == "File"
  | extend FileShared = tostring(ObjectName)
  | where isnotempty(FileShared)
  | mv-expand ActivityObjects
  | where ActivityObjects.Type == "Account" and ActivityObjects.Role == "To"
  | extend SharedBy = AccountId
  | extend UserSharedWith = tostring(ActivityObjects.Name)
  | summarize dcount(UserSharedWith) by FileShared, AccountObjectId
  | where dcount_UserSharedWith >= 20
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.