cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Whether you are transferring a single drive, a team or an entire organization, Movebot's cloud migration tool has been built to make your Dropbox migration simple - learn all about it here.

Dropbox installs & integrations

Connect your tools and content together with help from the Dropbox Community. Join a discussion or post a question of your own to get started.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Does Dropbox Run Powershell Commands?

Does Dropbox Run Powershell Commands?

Mercury415
New member | Level 2

Hello,

our endpoint software picked up dropbox running this command - C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell "Get-AppxPackage C27EB4BA.DropboxOEM | Remove-AppxPackage" 

I saw the exact command in another forum and the user said that Dropbox uses it for updates. Can anyone confirm this? Is there somewhere online with more information on the powershell commands that Dropbox uses?

1 Accepted Solution

Accepted Solutions

Re: Does Dropbox Run Powershell Commands?

Ross_S
Dropboxer

Hi there,

Yes, this looks expected, we call that when we uninstall the DropboxOEM. You'll only see this on Windows 10 as it related to the UWP version of our app. 

Via Powershell we're uninstalling the DropboxOEM from system level so that it does not get installed again. This effectively cancels scheduled installation of DropboxOEM.

There shouldn't be anything to be worried about here, this is acting as designed.

Hope this helps!

 

View solution in original post

9 Replies 9

Re: Does Dropbox Run Powershell Commands?

Jane
Dropboxer
Hey @Mercury415, let me forward your inquiry to a team specialist in form of a question. To get going with that, I’ve sent you a brief message on the email address connected to your Community profile. 
 
Whenever you have some spare time, please have a look at your inbox for my message & I’ll make sure to promptly follow-up with you asap. Thanks in advance- I’ll be awaiting your next reply!

 


Jane
Community Moderator @ Dropbox
dropbox.com/support

 

Heart Did this post help you? If so please give it a Like below. 
:white_check_mark: Did this post fix your issue/answer your question? If so please press the 'Accept as Best Answer' button to help others find it.
:arrows_counterclockwise: Still stuck? Ask me a question! (
Questions asked in the community will likely receive an answer within 4 hours!)

Re: Does Dropbox Run Powershell Commands?

Kombi
New member | Level 2

Any update?

Re: Does Dropbox Run Powershell Commands?

Wumbowarrior
New member | Level 2

Just ran into the same problem. Is this some kind of malicious credential dump, or is this normal behavior from DropBox?

Re: Does Dropbox Run Powershell Commands?

Wumbowarrior
New member | Level 2

We have run into this exact same behavior, which was detected with our endpoint software. Is it normal for DropBox to operate in this way? I'm concerned that someone may have maliciously hijacked powershell to dump credentials to a dropbox account.

Re: Does Dropbox Run Powershell Commands?

Jane
Dropboxer
Hey @Kombi & @Wumbowarrior, thanks for the nudge; I’m afraid I don’t have any news to share, however I’ll do my best to follow-up on your concern. 
 
  • If it’s not too much trouble for you, could you also please send a screenshot of any diagnostic messages you received (including any error messages in case you're getting any)?
  • Could you let me know what's the name of the application that picked the file in question? 
Any detail you could include on this discussion would be very helpful & thanks in advance for the time you're devoting to work on that with me! 

 


Jane
Community Moderator @ Dropbox
dropbox.com/support

 

Heart Did this post help you? If so please give it a Like below. 
:white_check_mark: Did this post fix your issue/answer your question? If so please press the 'Accept as Best Answer' button to help others find it.
:arrows_counterclockwise: Still stuck? Ask me a question! (
Questions asked in the community will likely receive an answer within 4 hours!)

Re: Does Dropbox Run Powershell Commands?

Kombi
New member | Level 2

It is not an error - Our endpoint security picked up dropbox running this command - C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell "Get-AppxPackage C27EB4BA.DropboxOEM | Remove-AppxPackage"  

Is it normal for DropBox to operate in this way?

Re: Does Dropbox Run Powershell Commands?

Jane
Dropboxer

Thanks for looping back to me here @Kombi, I’ve submitted your inquiry for review internally & I’ll circle back to you once I have a bit more info to share!

 


Jane
Community Moderator @ Dropbox
dropbox.com/support

 

Heart Did this post help you? If so please give it a Like below. 
:white_check_mark: Did this post fix your issue/answer your question? If so please press the 'Accept as Best Answer' button to help others find it.
:arrows_counterclockwise: Still stuck? Ask me a question! (
Questions asked in the community will likely receive an answer within 4 hours!)

Re: Does Dropbox Run Powershell Commands?

Ross_S
Dropboxer

Hi there,

Yes, this looks expected, we call that when we uninstall the DropboxOEM. You'll only see this on Windows 10 as it related to the UWP version of our app. 

Via Powershell we're uninstalling the DropboxOEM from system level so that it does not get installed again. This effectively cancels scheduled installation of DropboxOEM.

There shouldn't be anything to be worried about here, this is acting as designed.

Hope this helps!

 

Re: Does Dropbox Run Powershell Commands?

khogan
New member | Level 2

This is so bad in the day and age in which companies are using Products like Cylance to block Scripts specifcially Powershell from C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell

Who's talking

Top contributors to this post

  • User avatar
    khogan New member | Level 2
  • User avatar
    Ross_S Dropboxer
  • User avatar
    Jane Dropboxer
  • User avatar
    Kombi New member | Level 2
What do Dropbox user levels mean?
Need more support?