lazagne

id: 97839232-ff2c-4924-983d-f21d25276e88
name: lazagne
description: |
  This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog.
  Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.
  During a typical Ryuk campaign, an operator will use LaZagne, a credential theft tool, to access stored passwords for service accounts. The accounts are then used to jump from desktop clients to servers or domain controllers, allowing for better reconnaissance, faster movement, and a more severe impact on the target.
  The following query detects credential theft by LaZagne.
  The See also section below lists links to other queries associated with Ryuk ransomware.
  References:
  https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
  https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk&threatId=-2147232689
  https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
  https://github.com/AlessandroZ/LaZagne
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Credential Access
query: |
  // Find credential theft via SAM database export by LaZagne
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where FileName =~ 'reg.exe'
      and ProcessCommandLine has 'save'
      and ProcessCommandLine has 'hklm'
      and ProcessCommandLine has 'sam'
  | project DeviceId, Timestamp, InitiatingProcessId,
  InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine