Windows Process Execution: LaZagne Credential Dumping Utility (lazagne.exe)

title: "Windows Process Execution: LaZagne Credential Dumping Utility (lazagne.exe)"
id: abacc593-5616-4a72-aa25-045d96a53e15
status: experimental
description: This rule flags execution of the LaZagne utility on Windows, including common command-line module selections and options associated with credential collection. Attackers use LaZagne to extract passwords and other sensitive data from local systems, enabling follow-on account access and lateral movement. It relies on Windows process creation telemetry, matching process image names and command-line contents tied to LaZagne’s typical usage patterns.
references:
  - https://github.com/AlessandroZ/LaZagne/tree/master
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  - https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/
  - https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/
  - https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/800c0e06571993a54e39571cf27fd474dcc5c0bc/2017/2017.11.14.Muddying_the_Water/muddying-the-water-targeted-attacks.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_lazagne.yml
author: Nasreddine Bencherchali, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2024-06-24
modified: 2025-10-07
tags:
  - attack.credential-access
logsource:
  product: windows
  category: process_creation
detection:
  selection_img_metadata:
    Image|endswith: \lazagne.exe
  selection_img_cli:
    Image|contains:
      - :\PerfLogs\
      - :\ProgramData\
      - :\Temp\
      - :\Tmp\
      - :\Users\Public\
      - :\Windows\Temp\
      - \$Recycle.bin
      - \AppData\
      - \Desktop\
      - \Downloads\
      - \Favorites\
      - \Links\
      - \Music\
      - \Photos\
      - \Pictures\
      - \Saved Games\
      - \Searches\
      - \Users\Contacts\
      - \Users\Default\
      - \Users\Searches\
      - \Videos\
      - \Windows\addins\
      - \Windows\Fonts\
      - \Windows\IME\
    CommandLine|endswith:
      - .exe all
      - .exe browsers
      - .exe chats
      - .exe databases
      - .exe games
      - .exe git
      - .exe mails
      - .exe maven
      - .exe memory
      - .exe multimedia
      - .exe sysadmin
      - .exe unused
      - .exe wifi
      - .exe windows
  selection_cli_modules:
    CommandLine|contains:
      - " all "
      - " browsers "
      - " chats "
      - " databases "
      - " games "
      - " mails "
      - " maven "
      - " memory "
      - " multimedia "
      - " php "
      - " svn "
      - " sysadmin "
      - " unused "
      - " wifi "
  selection_cli_options:
    CommandLine|contains:
      - -1Password
      - -apachedirectorystudio
      - -autologon
      - -ChromiumBased
      - -coreftp
      - -credfiles
      - -credman
      - -cyberduck
      - -dbvis
      - -EyeCon
      - -filezilla
      - -filezillaserver
      - -ftpnavigator
      - -galconfusion
      - -gitforwindows
      - -hashdump
      - -iisapppool
      - -IISCentralCertP
      - -kalypsomedia
      - -keepass
      - -keepassconfig
      - -lsa_secrets
      - -mavenrepositories
      - -memory_dump
      - -Mozilla
      - -mRemoteNG
      - -mscache
      - -opensshforwindows
      - -openvpn
      - -outlook
      - -pidgin
      - -postgresql
      - -psi-im
      - -puttycm
      - -pypykatz
      - -Rclone
      - -rdpmanager
      - -robomongo
      - -roguestale
      - -skype
      - -SQLDeveloper
      - -squirrel
      - -tortoise
      - -turba
      - -UCBrowser
      - -unattended
      - -vault
      - -vaultfiles
      - -vnc
      - -winscp
  condition: 1 of selection_img_* or all of selection_cli_*
falsepositives:
  - Some false positive is expected from tools with similar command line flags.
level: medium
license: DRL-1.1
related:
  - id: c2b86e67-b880-4eec-b045-50bc98ef4844
    type: derived