{
  "family": "lazagne",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Lazagne is an open-source, highly versatile **Credential Dumper** and password recovery utility available on GitHub. While designed for legitimate penetration testing and sysadmin password recovery, it is almost exclusively seen in the wild as a weaponized post-exploitation tool (`T1003`). Once an attacker breaches a network, they deploy Lazagne to automatically harvest saved passwords, SSH keys, and tokens from dozens of supported applications (browsers, chat clients, databases, sysadmin tools) stored on the compromised endpoint.<br><br><b>Understanding the Lazagne Threat</b><br>To an IT administrator, Lazagne might seem like a useful recovery utility. To a SOC analyst, the execution of `lazagne.exe` (or its Python script equivalent) is a 'Code Red' indicator of a severe, interactive network breach. It means an attacker has bypassed perimeter defenses, escalated privileges on a host, and is now attempting to harvest credentials to pivot laterally across the enterprise domain.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Lazagne is typically dropped onto a victim machine *after* an initial compromise (e.g., via a phishing payload or an RDP brute-force attack) (`T1105`). The attacker usually executes it from a command shell with administrative privileges (`T1059.003`). Lazagne then automatically iterates through its modules (`T1082`). It queries the Windows Registry (`T1012`), parses SQLite databases used by browsers like Chrome and Firefox (`T1555.003`), extracts Wi-Fi profiles (`T1555.004`), and decrypts stored credentials using the Windows Data Protection API (DPAPI) (`T1555.004`). It outputs the harvested credentials in cleartext to the console or a text file for the attacker to exfiltrate.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the mass compromise of user identities, potentially granting the attacker Domain Admin privileges if an admin recently logged into the box. Host-based IoCs include EDR alerts for the execution of `lazagne.exe` (often renamed to evade simple blacklists), or alerts for anomalous processes querying multiple browser profile directories and DPAPI functions in rapid succession. The presence of a newly created `passwords.txt` or `creds.json` file in a temporary directory is a strong indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1555.004",
    "T1003",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1003",
      "name": "OS Credential Dumping (Using Lazagne to extract hashes/cleartext)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Dropping the tool post-compromise)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1555.004",
      "name": "Credentials from Password Stores: Windows Credential Manager (DPAPI extraction)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network; if Lazagne was executed, an attacker has interactive control.",
    "Assume all credentials stored on or entered into the compromised machine have been stolen. Force an immediate password reset for the user's Active Directory account.",
    "If an IT administrator recently logged into the compromised machine via RDP or PsExec, you must assume the Domain Admin credentials were also dumped.",
    "Search EDR logs enterprise-wide for the specific file hash of the Lazagne executable found, as the attacker likely deployed it to multiple machines."
  ],
  "what_to_avoid": [
    "Do not allow users to save corporate passwords in web browsers; enforce the use of secure, enterprise password managers that do not store credentials in easily parsed SQLite files.",
    "Avoid treating Lazagne detection as a 'low severity' PUA/HackTool alert; it is a critical indicator of post-exploitation activity."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}