macOS Process Creation: grep 'password' or laZagne Credential Extraction

Detects macOS executions of grep targeting 'password' strings and laZagne, suggesting local credential extraction attempts.

FreeReviewedSigma · High · v2

Product: macos
Category: process_creation
Author: Igor Fits, Mikhail Larin, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-19
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags macOS process creation events where an executable ending with '/grep' is invoked with a command line containing the term 'password', or where the command line contains 'laZagne'. Such activity can indicate attempts to locate or extract credentials from files during credential access operations. It relies on process creation telemetry, specifically the image path ending and the command line content.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious Access to Cloud and Database Credential Files via Process

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)

Suspicious RegAsm MSBuild or AutoIt Accessing Browser Credential Stores

macOS Process Creation: grep 'password' or laZagne Credential Extraction

Pivot detection · T1552.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-activity-grep-for-password-and-lazagne-credential-extraction-53b1b378

title: "macOS Process Creation: grep 'password' or laZagne Credential Extraction"
id: 143b6162-e2ac-472d-b189-1057accaf735
status: test
description: This rule flags macOS process creation events where an executable ending with '/grep' is invoked with a command line containing the term 'password', or where the command line contains 'laZagne'. Such activity can indicate attempts to locate or extract credentials from files during credential access operations. It relies on process creation telemetry, specifically the image path ending and the command line content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_find_cred_in_files.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1552.001
logsource:
  product: macos
  category: process_creation
detection:
  selection1:
    Image|endswith: /grep
    CommandLine|contains: password
  selection2:
    CommandLine|contains: laZagne
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 53b1b378-9b06-4992-b972-dde6e423d2b4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL