Login into LastPass from a previously unknown IP.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query will check how many activity there is in LastPass from IPs that are not seen before in the Sign-in Logs

Attribute	Value
Type	Hunting Query
Solution	Lastpass Enterprise Activity Monitoring
ID	d292d770-69a4-4399-9272-6e86c4e53e58
Tactics	InitialAccess
Techniques	T1078, T1190
Required Connectors	LastPass, AzureActiveDirectory
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
SigninLogs	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Lastpass Enterprise Activity Monitoring