Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1555-credentials-from-password-stores

VIEW RULE IN DATADOG VIEW SIGNALS

Set up the lastpass integration.

Goal

Detect when a LastPass user attempts to modify a vault item.

Strategy

This rule monitors LastPass account logs to determine when a vault item is modified. This could indicate an attempt to modify an item.

Triage and response

1. Investigate the user: {{@usr.name}} who triggered the event {{@evt.name}} involving vault item {{@VID}} within the vault.
2. If this action was unintended by the user:
   • Rotate the user’s LastPass master password
   • Identify all the items that were modified and rotate the necessary authentication credentials