Detection rules › Sublime MQL
Brand impersonation: LastPass
Detects messages impersonating the password manager LastPass that contain suspicious language about maintenance, vault exports, or master passwords.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and length(body.links) > 0
and any([sender.display_name, sender.email.domain.domain],
strings.ilike(strings.replace_confusables(.), "*LastPass*", "Last?Pass")
)
and (
strings.ilike(body.current_thread.text,
"*back*up*",
"*maintenance*",
"*master*password*",
"*export*vault*",
"*support@lastpass.com*" // real LastPass support address
)
or any(body.links,
// links directly to a S3 bucket
(
.href_url.domain.root_domain == "amazonaws.com"
and strings.icontains(.href_url.domain.subdomain, "s3")
)
// recipient email as a URL param
or any(.href_url.query_params_decoded["email"],
strings.parse_email(.).email in map(recipients.to, .email.email)
)
)
or any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ("Security and Authentication", "Reminders and Notifications")
and .confidence != "low"
)
// invalid sender address
or not sender.email.domain.valid
)
// negate newsletters
and not any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ("Newsletters and Digests") and .confidence != "low"
)
and not (
sender.email.domain.root_domain in~ ("lastpass.com")
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects messages impersonating the password manager LastPass that contain suspicious language about maintenance, vault exports, or master passwords.
- inbound message
- length(body.links) > 0
any of
[sender.display_name, sender.email.domain.domain]where:strings.replace_confusables(.) matches any of 2 patterns
*LastPass*Last?Pass
any of:
body.current_thread.text matches any of 5 patterns
*back*up**maintenance**master*password**export*vault**support@lastpass.com*
any of
body.linkswhere any holds:all of:
- .href_url.domain.root_domain is 'amazonaws.com'
- .href_url.domain.subdomain contains 's3'
any of
.href_url.query_params_decoded['email']where:- strings.parse_email(.).email in map(recipients.to, .email.email)
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name in ('Security and Authentication', 'Reminders and Notifications')
- .confidence is not 'low'
not:
- sender.email.domain.valid
not:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name in ('Newsletters and Digests')
- .confidence is not 'low'
not:
all of:
- sender.email.domain.root_domain in ('lastpass.com')
- headers.auth_summary.dmarc.pass
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, body.links[].href_url.query_params_decoded['email'], headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.email, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.domain.valid, type.inbound. Sensors: ml.nlu_classifier, strings.icontains, strings.ilike, strings.parse_email, strings.replace_confusables.
Indicators matched (13)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *LastPass* |
strings.ilike | substring | Last?Pass |
strings.ilike | substring | *back*up* |
strings.ilike | substring | *maintenance* |
strings.ilike | substring | *master*password* |
strings.ilike | substring | *export*vault* |
strings.ilike | substring | *support@lastpass.com* |
body.links[].href_url.domain.root_domain | equals | amazonaws.com |
strings.icontains | substring | s3 |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Security and Authentication |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Reminders and Notifications |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Newsletters and Digests |
1 more
sender.email.domain.root_domain | member | lastpass.com |