tool

LaZagne S0349

Type: tool
Platforms: Linux, macOS, Windows
Created: 30 January 2019
Last modified: 4 April 2024

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

Techniques47th pct

TacticBottom 6%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0349

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...)	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-10-09	fb4c31b0-13e8-4155-8aa5-24de4b8d6717
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
	Detects file access requests to the Windows Credential History File by an uncommon application. (...)	Generic	test	file_access	windows	-	Credential Access Credentials from Password Stores Windows Credential Manager	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-17	2024-07-29	7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2
	Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. (...)	Generic	test	file_access	windows	-	Credential Access Credentials from Password Stores Windows Credential Manager	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-17	2026-07-28	46612ae6-86be-4802-bc07-39b59feb1309
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
	Identifies when a key vault is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	459a2970-bb84-4e6a-a32e-ff0fbd99448d
	Identifies when a Keyvault Key is modified or deleted in Azure.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	80eeab92-0979-4152-942d-96749e11df40
	Identifies when secrets are modified or deleted in Azure.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	b831353c-1971-477b-abb6-2828edc3bca1
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Detects when the file "passwd" or "shadow" is copied from tmp path	Generic	test	process_creation	linux	Sysmon	Credential Access Unsecured Credentials Credentials In Files	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-01-31	—	fa4aaed5-4fe0-498d-bbc0-08e3346387ba
Splunk	The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). (...)	Generic	stable	create_remote_thread	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-06-29	67d4dbef-9564-4699-8da8-03a151529edc
	Detects uses of the createdump.exe LOLOBIN utility to dump process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-04	2022-08-19	515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
Splunk	The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. (...)	Generic	stable	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Michael Haag, Splunk	2019-12-11	2026-10-02	b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
	Files with well-known filenames (parts of credential dump software or files produced by them) creati (...)	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory Security Account Manager NTDS LSA Secrets	-	high	Teymur Kheirkhabarov, oscd.community	2019-11-01	2025-10-25	8fbf3271-1ef6-4e94-8210-03c2317947f6
	Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj, Jonhnathan Ribeiro	2023-11-27	2023-11-29	f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9
	Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.	Generic	test	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-06-27	2023-11-29	e5b33f7d-eb93-48b6-9851-09e1e610b6d7
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	f0d1feba-4344-4ca9-8121-a6c97bd6df52
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog System	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	4976aa50-8f41-45c6-8b15-ab3fc10e79ed
	Detects passwords dumps from Keychain	Generic	test	process_creation	macos	-	Credential Access Credentials from Password Stores Keychain	-	medium	Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems)	2020-10-19	2021-11-27	b120b587-a4c2-4b94-875d-99c9807d6955
	Detecting attempts to extract passwords with grep and laZagne	Generic	test	process_creation	macos	-	Credential Access Unsecured Credentials Credentials In Files	-	high	Igor Fits, Mikhail Larin, oscd.community	2020-10-19	2021-11-27	53b1b378-9b06-4992-b972-dde6e423d2b4
	Detecting attempts to extract passwords with grep	Generic	test	process_creation	linux	Linux Auditd	Credential Access Unsecured Credentials Credentials In Files	-	high	Igor Fits, oscd.community	2020-10-15	2023-04-30	df3fcaea-2715-4214-99c5-0056ea59eb35
	Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process. (...)	Hunting	test	image_load	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Perez Diego (@darkquassar), oscd.community, Ecco	2019-10-27	2024-03-01	0e277796-5f23-4e49-a490-483131d4f6e1
Splunk	The following analytic detects attempts to read LSASS memory, indicative of credential dumping. (...)	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-10-09	2c365e57-4414-4540-8dc0-73ab10729996
	Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.	Generic	test	file_event	windows	Sysmon	Credential Access Credentials from Password Stores Credential Access Unsecured Credentials Private Keys	-	high	Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)	2024-06-26	—	7892ec59-c5bb-496d-8968-e5d210ca3ac4
	Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers	Generic	test	account_management	windows	WinEventLog Security	Credential Access OS Credential Dumping LSA Secrets	-	high	Roberto Rodriguez @Cyb3rWard0g	2019-06-20	2022-02-24	4ac1f50b-3bd0-4968-902d-868b4647937e
	Detects anyone attempting a backup for the DPAPI Master Key. (...)	Generic	test	-	windows	WinEventLog Security	Credential Access OS Credential Dumping LSA Secrets	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-10	2023-03-15	39a94fd1-8c9a-4ff6-bf22-c058762f8014
	Adversaries may search for common password storage locations to obtain user credentials. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores	-	medium	frack113	2021-12-20	2022-12-25	99c49d9c-34ea-45f7-84a7-4751ae6b2cbc
Splunk	The following analytic detects the behavior of dumping credentials from memory by exploiting the Local Security Authority Subsystem Service (LSASS) using the comsvcs.dll and MiniDump via rundll32. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-10-16	2026-10-02	8943b567-f14d-4ee8-a0bb-2121d4ce3184
Splunk	The following analytic detects the use of procdump.exe to dump the LSASS process, specifically looki (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Credential Access OS Credential Dumping LSASS Memory	-	medium	Michael Haag, Splunk	2021-02-01	2026-10-02	3742ebfe-64c2-11eb-ae93-0242ac130002
	Detects the usage of "reg.exe" in order to dump sensitive registry hives. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping Security Account Manager LSA Secrets Cached Domain Credentials	-	high	Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113	2019-10-22	2023-12-13	fd877b94-9bb5-4191-bb25-d79cbd93c167
	Detects process dump via legitimate sqldumper.exe binary	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	medium	Kirill Kiryanov, oscd.community	2020-10-08	2021-11-27	23ceaf5c-b6f1-4a32-8559-f2ff734be516
	Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of t (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	medium	Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)	2022-04-06	2023-04-12	dee0a7a3-f200-4112-a99b-952196d81e42
	Adversaries may search for common password storage locations to obtain user credentials. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores	-	medium	frack113	2021-12-20	2022-12-25	603c6630-5225-49c1-8047-26c964553e0e
Splunk	This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System Credential Access OS Credential Dumping /etc/passwd and /etc/shadow	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	6fa0073d-6ca0-4f93-913d-fb420c9de15b	-
	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-12-19	2022-12-25	bd5971a7-626d-46ab-8176-ed643f694f68
	Detects file creation events with filename patterns used by CrackMapExec.	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Nasreddine Bencherchali (Nextron Systems)	2024-03-11	2024-06-27	736ffa74-5f6f-44ca-94ef-1c0df4f51d2a
	Detects suspicious process patterns found in logs when CrackMapExec is used	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-03-12	2023-02-13	f26307d8-14cd-47e3-a26b-4b4769f24af6
	Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential ext (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2019-12-22	2024-11-23	36d88494-1d43-4dc0-b3fa-35c8fea0ca9d
	Detects well-known credential dumping tools execution via specific named pipe creation	Generic	test	pipe_created	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials	-	critical	Teymur Kheirkhabarov, oscd.community	2019-11-01	2023-08-07	961d0ba2-3eea-4303-a930-2cf78bbfcc5e
	Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process clo (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-07-01	—	d474c8fe-bb69-4ea0-b7d9-f682b56d52d3
	Detects the creation of the default dump file used by Outflank Dumpert tool. (...)	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2020-02-04	2023-05-09	93d94efc-d7ad-4161-ad7d-1638c4f908d8
	Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2020-02-04	2026-09-16	2704ab9e-afe2-4854-a3b1-0c0706d03578
	Detects process access requests from hacktool processes based on their default image name	Generic	test	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel	2023-11-27	—	d0d2f720-d14f-448d-8242-51ff396a334e
	Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...)	Generic	test	process_access	windows	Sysmon	Execution Native API Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj (rule), @thefLinkk	2022-06-27	2023-11-28	b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
	Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in orde (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-08-18	2024-11-23	ca621ba5-54ab-4035-9942-d378e6fcde3c
	Detects file creation events with filename patterns used by Impacket.	Generic	experimental	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	The DFIR Report, IrishDeath	2025-05-19	—	03f4ca17-de95-428d-a75a-4ee78b047256

Title

Description

LaZagne S0349

LaZagne MITRE reference S0349

Standing S0349

Reach

Coverage

LaZagne detections S0349