Unusual Volume of Password Updated or Removed
This rule will check if there is an unnormal activity of sites that are deleted or changed per user. The normal amount of actions is calculated based on the previous 14 days of activity. If there is a significant…
Description
This rule will check if there is an unnormal activity of sites that are deleted or changed per user. The normal amount of actions is calculated based on the previous 14 days of activity. If there is a significant increase, an incident will be created.
Detection logic
Detection requirements
- Platform
- ContainersESXiIaaSLinuxmacOSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- lastpass
- Log source service
- lastpassnativepoller_cl
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- a3bbdf60-0a6d-4cc2-b1d1-dd70aca184ce
- Tagged by the source as
- Impact
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1