[IA] - Detect LastPass Hack Emails attempts to trick users into installing Malware
CyberSecurityNews has reported a raising case about a new wave of phishing emails masquerading as breach notifications from LastPass. To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access. In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system. Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks. This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
Microsoft Sentinel (KQL)
