Windows: Detect LaZagne Password Recovery Tool Execution

title: "Windows: Detect LaZagne Password Recovery Tool Execution"
id: abacc593-5616-4a72-aa25-045d96a53e15
status: experimental
description: This rule identifies execution of the LaZagne credential-recovery utility on Windows by matching process creation events for lazagne.exe and specific command-line patterns. Attackers can use LaZagne to harvest multiple types of locally stored credentials, making execution an important signal for credential access activity. Detection relies on Windows process creation telemetry including the executable name and command line contents that correspond to LaZagne modules and options.
references:
  - https://github.com/AlessandroZ/LaZagne/tree/master
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  - https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/
  - https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/
  - https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/800c0e06571993a54e39571cf27fd474dcc5c0bc/2017/2017.11.14.Muddying_the_Water/muddying-the-water-targeted-attacks.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_lazagne.yml
author: Nasreddine Bencherchali, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2024-06-24
modified: 2025-10-07
tags:
  - attack.credential-access
logsource:
  product: windows
  category: process_creation
detection:
  selection_img_metadata:
    Image|endswith: \lazagne.exe
  selection_img_cli:
    Image|contains:
      - :\PerfLogs\
      - :\ProgramData\
      - :\Temp\
      - :\Tmp\
      - :\Users\Public\
      - :\Windows\Temp\
      - \$Recycle.bin
      - \AppData\
      - \Desktop\
      - \Downloads\
      - \Favorites\
      - \Links\
      - \Music\
      - \Photos\
      - \Pictures\
      - \Saved Games\
      - \Searches\
      - \Users\Contacts\
      - \Users\Default\
      - \Users\Searches\
      - \Videos\
      - \Windows\addins\
      - \Windows\Fonts\
      - \Windows\IME\
    CommandLine|endswith:
      - .exe all
      - .exe browsers
      - .exe chats
      - .exe databases
      - .exe games
      - .exe git
      - .exe mails
      - .exe maven
      - .exe memory
      - .exe multimedia
      - .exe sysadmin
      - .exe unused
      - .exe wifi
      - .exe windows
  selection_cli_modules:
    CommandLine|contains:
      - " all "
      - " browsers "
      - " chats "
      - " databases "
      - " games "
      - " mails "
      - " maven "
      - " memory "
      - " multimedia "
      - " php "
      - " svn "
      - " sysadmin "
      - " unused "
      - " wifi "
  selection_cli_options:
    CommandLine|contains:
      - -1Password
      - -apachedirectorystudio
      - -autologon
      - -ChromiumBased
      - -coreftp
      - -credfiles
      - -credman
      - -cyberduck
      - -dbvis
      - -EyeCon
      - -filezilla
      - -filezillaserver
      - -ftpnavigator
      - -galconfusion
      - -gitforwindows
      - -hashdump
      - -iisapppool
      - -IISCentralCertP
      - -kalypsomedia
      - -keepass
      - -keepassconfig
      - -lsa_secrets
      - -mavenrepositories
      - -memory_dump
      - -Mozilla
      - -mRemoteNG
      - -mscache
      - -opensshforwindows
      - -openvpn
      - -outlook
      - -pidgin
      - -postgresql
      - -psi-im
      - -puttycm
      - -pypykatz
      - -Rclone
      - -rdpmanager
      - -robomongo
      - -roguestale
      - -skype
      - -SQLDeveloper
      - -squirrel
      - -tortoise
      - -turba
      - -UCBrowser
      - -unattended
      - -vault
      - -vaultfiles
      - -vnc
      - -winscp
  condition: 1 of selection_img_* or all of selection_cli_*
falsepositives:
  - Some false positive is expected from tools with similar command line flags.
level: medium
license: DRL-1.1
related:
  - id: c2b86e67-b880-4eec-b045-50bc98ef4844
    type: derived