S0349 LaZagne

toolEnterprise

platformsLinux · macOS · Windows

also known asLaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.

techniques used (10)

ATT&CK techniques this enables or maps to.

T1003.001LSASS Memory
T1003.004LSA Secrets
T1003.005Cached Domain Credentials
T1003.007Proc Filesystem
T1003.008/etc/passwd and /etc/shadow
T1552.001Credentials In Files
T1555Credentials from Password Stores
T1555.001Keychain
T1555.003Credentials from Web Browsers
T1555.004Windows Credential Manager

used by groups (12)

Threat groups associated with this.

G0022APT3
G0064APT33
G1024Akira
G0120Evilnum
G0100Inception
G0077Leafminer
G0069MuddyWater
G0049OilRig
G1015Scattered Spider
G0139TeamTNT
G0131Tonto Team
G0102Wizard Spider

Detected by (Sigma) (1)

Sigma detection rules related to this.

f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9Credential Dumping Activity By Python Based Toolhigh

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan