LaZagne Credential Theft

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

LaZagne is a popular open-source tool used to recover passwords stored on a local computer. It has been used in ransomware attacks to steal credentials and escalate privileges. This query looks for the execution of LaZagne.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

id: 7d0d3050-8dac-4b83-bfae-902f7dc0c21c
name: LaZagne Credential Theft
description: |
  LaZagne is a popular open-source tool used to recover passwords stored on a local computer. It has been used in ransomware attacks to steal credentials and escalate privileges. This query looks for the execution of LaZagne.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1003
query: |
  DeviceProcessEvents 
  | where FileName =~ 'reg.exe'
  | where ProcessCommandLine has_all('save','hklm','sam')
  | project DeviceId, DeviceName, TimeGenerated, InitiatingProcessId, InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine
  | extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
  | extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")
entityMappings:  
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: Process
    fieldMappings:
      - identifier: ProcessId
        columnName: ProcessId
      - identifier: CommandLine
        columnName: ProcessCommandLine
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

DeviceProcessEvents

Stage 2: `where`

| where FileName =~ 'reg.exe'

Stage 3: `where`

| where ProcessCommandLine has_all('save','hklm','sam')

Stage 4: `project`

| project DeviceId, DeviceName, TimeGenerated, InitiatingProcessId, InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine

Stage 5: `extend`

| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)

HostName =

ifDeviceName has "."substring(DeviceName, 0, indexof(DeviceName, '.'))

elseDeviceName

Stage 6: `extend`

| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")

DnsDomain =

ifDeviceName has "."substring(DeviceName, (indexof(DeviceName, '.') + 1))

else""

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`FileName`	eq	`reg.exe`	`field:"file_name" kind:eq value:"reg.exe"`
`ProcessCommandLine`	match	`hklm` transforms: `term` corpus 4 (sigma 3, kusto 1) `sam` transforms: `term` `save` transforms: `term` corpus 2 (sigma 1, kusto 1)	`field:"CommandLine" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DeviceId`	`project`
`DeviceName`	`project`
`FileName`	`project`
`InitiatingProcessFileName`	`project`
`InitiatingProcessId`	`project`
`ProcessCommandLine`	`project`
`ProcessId`	`project`
`TimeGenerated`	`project`
`HostName`	`extend`
`DnsDomain`	`extend`

LaZagne Credential Theft

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: project

Stage 5: extend

Stage 6: extend