Dropbox Many Downloads

AnalysisType: rule
Filename: dropbox_many_downloads.py
RuleID: "Dropbox.BulkDownloads"
DisplayName: "Dropbox Many Downloads"
Status: Experimental
Enabled: false
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 11
LogTypes:
  - Dropbox.TeamEvent
Description: >
  Detects when a Dropbox user downloads more than 10 distinct files within 60 minutes.
  This may indicate data exfiltration or unauthorized bulk access to team files.
  The threshold should be tuned to your environment.
Reference: https://learn.dropbox.com/video-library/upload-and-download-files
Reports:
  MITRE ATT&CK:
    - TA0010:T1567
Tags:
  - Dropbox
  - Exfiltration
Runbook: |
  1. Query Dropbox.TeamEvent for all file_download events by actor:user:email in the 2 hours around this alert to identify the full list of assets[0]:path:contextual values downloaded
  2. Check involve_non_team_member and the origin:geo_location:ip_address to determine if the downloads originated from an external user or an unexpected location
  3. Search for other suspicious activity by this user in the past 24 hours, including external sharing events, ownership transfers, or logins from new devices or locations
Tests:
  - Name: File Downloaded
    ExpectedResult: true
    Log:
      actor:
        user:
          email: alice@company.com
          _tag: team_member
      event_type:
        _tag: file_download
      assets:
        - path:
            contextual: /alice/report.pdf
      involve_non_team_member: false
      origin:
        geo_location:
          ip_address: 1.2.3.4
  - Name: File Downloaded - Non-Team Member Involved
    ExpectedResult: true
    Log:
      actor:
        user:
          email: alice@company.com
          _tag: team_member
      event_type:
        _tag: file_download
      assets:
        - path:
            contextual: /shared/contract.docx
      involve_non_team_member: true
      origin:
        geo_location:
          ip_address: 5.6.7.8
  - Name: Non-Download Event
    ExpectedResult: false
    Log:
      actor:
        user:
          email: alice@company.com
          _tag: team_member
      event_type:
        _tag: file_view
      assets:
        - path:
            contextual: /alice/report.pdf
      involve_non_team_member: false


# ------ paired body: dropbox_many_downloads.py ------

def rule(event):
    return event.deep_get("event_type", "_tag", default="") == "file_download"


def title(event):
    user = event.deep_get("actor", "user", "email", default="<UNKNOWN_USER>")
    return f"Dropbox: User [{user}] downloaded many files"


def dedup(event):
    return event.deep_get("actor", "user", "email", default="")


def unique(event):
    assets = event.get("assets", [])
    if assets:
        return assets[0].get("path", {}).get("contextual") or None
    return None


def severity(event):
    if event.get("involve_non_team_member", False):
        return "HIGH"
    return "DEFAULT"


def alert_context(event):
    assets = event.get("assets", [])
    file_path = assets[0].get("path", {}).get("contextual", "") if assets else ""
    return {
        "user": event.deep_get("actor", "user", "email"),
        "file_path": file_path,
        "involve_non_team_member": event.get("involve_non_team_member"),
        "ip_address": event.deep_get("origin", "geo_location", "ip_address"),
    }