sublimelowRule

Link: Direct link to Dropbox Paper file

Detects inbound messages containing links to Dropbox Paper documents using the /scl/fi/ sharing path with a .paper file extension and an rlkey query parameter. This pattern is commonly abused to host phishing content or malicious redirects behind Dropbox's trusted domain, allowing messages to bypass reputation-based filtering while luring recipients into opening a shared document.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598

initial-access

Detection Query

type.inbound
and any(body.current_thread.links,
        .href_url.domain.root_domain == "dropbox.com"
        and strings.istarts_with(.href_url.path, '/scl/fi/')
        and strings.iends_with(.href_url.path, '.paper')
        and 'rlkey' in keys(.href_url.query_params_decoded)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Link: Direct link to Dropbox Paper file"
description: "Detects inbound messages containing links to Dropbox Paper documents using the /scl/fi/ sharing path with a .paper file extension and an rlkey query parameter. This pattern is commonly abused to host phishing content or malicious redirects behind Dropbox's trusted domain, allowing messages to bypass reputation-based filtering while luring recipients into opening a shared document."
type: "rule"
severity: "low"
source: |
  type.inbound
  and any(body.current_thread.links,
          .href_url.domain.root_domain == "dropbox.com"
          and strings.istarts_with(.href_url.path, '/scl/fi/')
          and strings.iends_with(.href_url.path, '.paper')
          and 'rlkey' in keys(.href_url.query_params_decoded)
  )
  
tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Free file host"
  - "Social engineering"
  - "Out of band pivot"
detection_methods:
  - "URL analysis"
id: "0871677f-8dae-5cfc-8287-51a7b8bf3bc9"