Query: alert when Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer.
Matching passage: Sigma rule: Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer.. Logsource: windows / process_creation. Rule: title: HackTool - LaZagne Execution id: c2b86e67-b880-4eec-b045-50bc98ef4844 status: experimental description: 'Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials. ' references: - https://github.com/AlessandroZ/LaZagne/tree/master - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/ - https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/ - https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/800c0e06571993a54e39571cf27fd474dcc5c0bc/2017/2017.11.14.Muddying_the_Water/muddying-the-water-targeted-attacks.pdf author: Nasreddine Bencherchali, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2024-06-24 modified: 2025-10-07 tags: - attack.credential-access logsource: product: windows category: process_creation detection: selection_img_metadata: Image|endswith: \lazagne.exe selection_img_cli: Image|contains: - :\PerfLogs\ - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \$Recycle.bin - \AppData\ - \Desktop\ - \Downloads\ - \Favorites\ - \Links\ - \Music\ - \Photos\ - \Pictures\ - \Saved Games\ - \Searches\ - \Users\Contacts\ - \Users\Default\ - \Users\Searches\ - \Videos\ - \Windows\addins\ - \Windows\Fonts\ - \Windows\IME\ CommandLine|endswith: - .exe all - .exe browsers - .exe chats - .exe databases - .exe games - .exe git - .exe mails - .exe maven - .exe memory - .exe multimedia - .exe sysadmin - .exe unused - .exe wifi - .exe windows selection_cli_modules: CommandLine|contains: - ' all ' - ' browsers ' - ' chats ' - ' databases ' - ' games ' - ' mails ' - ' maven ' - ' memory ' - ' multimedia ' - ' php ' - ' svn ' - ' sysadmin ' - ' unused ' - ' wifi ' selection_cli_options: CommandLine|contains: - -1Password - -apachedirectorystudio - -autologon - -ChromiumBased - -coreftp - -credfiles - -credman - -cyberduck - -dbvis - -EyeCon - -filezilla - -filezillaserver - -ftpnavigator - -galconfusion - -gitforwindows - -hashdump - -iisapppool - -IISCentralCertP - -kalypsomedia - -keepass - -keepassconfig - -lsa_secrets - -mavenrepositories - -memory_dump - -Mozilla - -mRemoteNG - -mscache - -opensshforwindows - -openvpn - -outlook - -pidgin - -postgresql - -psi-im - -puttycm - -pypykatz - -Rclone - -rdpmanager - -robomongo - -roguestale - -s
Near-miss passage: Sigma rule: Detects value modification of registry key containing path to binary used as screensaver.. Logsource: windows / registry_event. Rule: title: Path To Screensaver Binary Modified id: 67a6c006-3fbe-46a7-9074-2ba3b82c3000 status: test description: Detects value modification of registry key containing path to binary used as screensaver. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-11 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Control Panel\Desktop\SCRNSAVE.EXE filter: Image|endswith: - \rundll32.exe - \explorer.exe condition: selection and not filter falsepositives: - Legitimate modification of screensaver level: medium