Query: detect Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. in logs
Matching passage: Sigma rule: Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer.. Logsource: windows / process_creation. Rule: title: HackTool - LaZagne Execution id: c2b86e67-b880-4eec-b045-50bc98ef4844 status: experimental description: 'Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials. ' references: - https://github.com/AlessandroZ/LaZagne/tree/master - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/ - https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/ - https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/800c0e06571993a54e39571cf27fd474dcc5c0bc/2017/2017.11.14.Muddying_the_Water/muddying-the-water-targeted-attacks.pdf author: Nasreddine Bencherchali, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2024-06-24 modified: 2025-10-07 tags: - attack.credential-access logsource: product: windows category: process_creation detection: selection_img_metadata: Image|endswith: \lazagne.exe selection_img_cli: Image|contains: - :\PerfLogs\ - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \$Recycle.bin - \AppData\ - \Desktop\ - \Downloads\ - \Favorites\ - \Links\ - \Music\ - \Photos\ - \Pictures\ - \Saved Games\ - \Searches\ - \Users\Contacts\ - \Users\Default\ - \Users\Searches\ - \Videos\ - \Windows\addins\ - \Windows\Fonts\ - \Windows\IME\ CommandLine|endswith: - .exe all - .exe browsers - .exe chats - .exe databases - .exe games - .exe git - .exe mails - .exe maven - .exe memory - .exe multimedia - .exe sysadmin - .exe unused - .exe wifi - .exe windows selection_cli_modules: CommandLine|contains: - ' all ' - ' browsers ' - ' chats ' - ' databases ' - ' games ' - ' mails ' - ' maven ' - ' memory ' - ' multimedia ' - ' php ' - ' svn ' - ' sysadmin ' - ' unused ' - ' wifi ' selection_cli_options: CommandLine|contains: - -1Password - -apachedirectorystudio - -autologon - -ChromiumBased - -coreftp - -credfiles - -credman - -cyberduck - -dbvis - -EyeCon - -filezilla - -filezillaserver - -ftpnavigator - -galconfusion - -gitforwindows - -hashdump - -iisapppool - -IISCentralCertP - -kalypsomedia - -keepass - -keepassconfig - -lsa_secrets - -mavenrepositories - -memory_dump - -Mozilla - -mRemoteNG - -mscache - -opensshforwindows - -openvpn - -outlook - -pidgin - -postgresql - -psi-im - -puttycm - -pypykatz - -Rclone - -rdpmanager - -robomongo - -roguestale - -s
Near-miss passage: Sigma rule: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.. Logsource: windows / file_event. Rule: title: Startup Folder File Write id: 2aa0a6b4-a865-495b-ab51-c28249537b75 related: - id: 28208707-fe31-437f-9a7f-4b1108b94d2e type: similar status: test description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/12 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-12-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\StartUp filter_main_update: - Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\uus\ARM64\wuaucltcore.exe - TargetFilename|startswith: - C:\$WINDOWS.~BT\NewOS\ - C:\$WinREAgent\Scratch\Mount\ filter_optional_onenote: Image|endswith: \ONENOTE.EXE TargetFilename|endswith: \Send to OneNote.lnk condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate level: medium