Sigma rule: HackTool - LaZagne Execution

Rule

Title

HackTool - LaZagne Execution

Status

experimental

Level

medium

Author

Nasreddine Bencherchali, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2024-06-24

Modified

2025-10-07

File

rules/windows/process_creation/proc_creation_win_hktl_lazagne.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer.
LaZagne has been leveraged multiple times by threat actors in order to dump credentials.

Log source

product

windows

category

process_creation

Detection

selection_img_metadata:
    Image|endswith: '\lazagne.exe'
selection_img_cli:
    # Note: This selection can be prone to FP. An initial baseline is required
    Image|contains:
        - ':\PerfLogs\'
        - ':\ProgramData\'
        - ':\Temp\'
        - ':\Tmp\'
        - ':\Users\Public\'
        - ':\Windows\Temp\'
        - '\$Recycle.bin'
        - '\AppData\'
        - '\Desktop\'
        - '\Downloads\'
        - '\Favorites\'
        - '\Links\'
        - '\Music\'
        - '\Photos\'
        - '\Pictures\'
        - '\Saved Games\'
        - '\Searches\'
        - '\Users\Contacts\'
        - '\Users\Default\'
        - '\Users\Searches\'
        - '\Videos\'
        - '\Windows\addins\'
        - '\Windows\Fonts\'
        - '\Windows\IME\'
    CommandLine|endswith:
        - '.exe all'
        - '.exe browsers'
        - '.exe chats'
        - '.exe databases'
        - '.exe games'
        - '.exe git'
        - '.exe mails'
        - '.exe maven'
        - '.exe memory'
        - '.exe multimedia'
        # - '.exe php' # Might be prone to FP
        # - '.exe svn' # Might be prone to FP
        - '.exe sysadmin'
        - '.exe unused'
        - '.exe wifi'
        - '.exe windows'
selection_cli_modules:
    CommandLine|contains:
        - ' all '
        - ' browsers '
        - ' chats '
        - ' databases '
        - ' games '
        - ' mails '
        - ' maven '
        - ' memory '
        - ' multimedia '
        - ' php '
        - ' svn '
        - ' sysadmin '
        - ' unused '
        - ' wifi '
selection_cli_options:
    CommandLine|contains:
        - '-1Password'
        - '-apachedirectorystudio'
        - '-autologon'
        - '-ChromiumBased'
        - '-coreftp'
        - '-credfiles'
        - '-credman'
        - '-cyberduck'
        - '-dbvis'
        - '-EyeCon'
        - '-filezilla'
        - '-filezillaserver'
        - '-ftpnavigator'
        - '-galconfusion'
        - '-gitforwindows'
        - '-hashdump'
        - '-iisapppool'
        - '-IISCentralCertP'
        - '-kalypsomedia'
        - '-keepass'
        - '-keepassconfig'
        - '-lsa_secrets'
        - '-mavenrepositories'
        - '-memory_dump'
        - '-Mozilla'
        - '-mRemoteNG'
        - '-mscache'
        - '-opensshforwindows'
        - '-openvpn'
        - '-outlook'
        - '-pidgin'
        - '-postgresql'
        - '-psi-im'
        - '-puttycm'
        - '-pypykatz'
        - '-Rclone'
        - '-rdpmanager'
        - '-robomongo'
        - '-roguestale'
        - '-skype'
        - '-SQLDeveloper'
        - '-squirrel'
        - '-tortoise'
        - '-turba'
        - '-UCBrowser'
        - '-unattended'
        - '-vault'
        - '-vaultfiles'
        - '-vnc'
        - '-winscp'
condition: 1 of selection_img_* or all of selection_cli_*

False positives (as the rule lists them)

• Some false positive is expected from tools with similar command line flags.

Tags

• attack.credential-access

References

• https://github.com/AlessandroZ/LaZagne/tree/master
• https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
• https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/
• https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/
• https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/800c0e06571993a54e39571cf27fd474dcc5c0bc/2017/2017.11.14.Muddying_the_Water/muddying-the-water-targeted-attacks.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_lazagne.yml