Detect Last Pass Hack Emails Attempts To Trick Users Into Installing Malware
Query
let Email_Zips = EmailAttachmentInfo | where FileType has "zip" | project FileName;
DeviceFileEvents
| extend FileOriginReferrerUrl_ext = extract(@"[^\\]+$", 0, FileOriginReferrerUrl)
| where isnotempty( FileOriginReferrerUrl)
| join kind=inner ( DeviceEvents) on $left.InitiatingProcessUniqueId == $right.InitiatingProcessUniqueId
| extend FileExtension = extract(@"\.([a-zA-Z0-9]+)$", 1, FileName)
| extend Source_Type = case(FileOriginReferrerUrl startswith "https://", "🌎 Web","📂 File")
| join kind=inner (Email_Zips) on $left.FileOriginReferrerUrl_ext == $right.FileName
| where FileName endswith ".msi"
| summarize total_Files= dcount(FileName), Files_after_execution= strcat("🗂️ ",make_set(FileName)),make_set(FileExtension),make_set(ActionType),make_set(FolderPath),SHA256_Group=make_set(SHA2561) by InitiatingProcessUniqueId,AccountUpn = strcat("👩🏻💻🧑🏾💻",InitiatingProcessAccountUpn), Device = strcat("💻 ",DeviceName), FileOriginReferrerUrl,Source_Type, OriginalFile=strcat("🚩 ",FileOriginReferrerUrl_ext), ReportId, Timestamp, DeviceIdAbout this query
Explanation
This KQL query is designed to detect phishing attempts that involve malicious emails pretending to be from LastPass. These emails trick users into downloading a fake security update, which is actually malware. Here's a simple breakdown of what the query does:
-
Identify ZIP Attachments in Emails: The query first looks for email attachments that are ZIP files. It extracts the file names of these attachments.
-
Track File Events: It then examines file events on devices, focusing on files that originate from URLs (likely from emails) and have a ".msi" extension, which indicates an installer file.
-
Match ZIP Contents with MSI Files: The query checks if the ZIP file contains an MSI file. This is important because the phishing emails use a ZIP file to deliver a malicious MSI file.
-
Correlate Events: By joining data from email attachments and device file events, the query identifies instances where a ZIP file from an email contains an MSI file, which is then executed on a device.
-
Summarize Findings: It summarizes the results, showing details like the number of files, file extensions, actions taken, file paths, and unique identifiers for processes and devices. It also includes user and device information to help identify affected accounts and systems.
Overall, this query helps detect and analyze phishing attempts that use ZIP files with MSI payloads, focusing on behavior patterns rather than specific file names, making it more adaptable to changes by attackers.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques