Fake ‘LastPass Hack’ Emails Trying to Trick Users Into Installing Malware
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Microsoft Sentinel (KQL)
