Let's take a quick look at some other resources that you might find useful.
LaZagne has a page on the Mitre ATT&CK website,
which contains details of the techniques it uses and the
groups that are known to have used it.
This is useful to understand how it's been used by real‑world attackers.
LaZagne is also included as a module in a tool called Pupy.
Pupy is an in‑memory remote administration tool.
The fact that it runs modules in memory makes it harder for
antivirus to detect, so it is potentially a good way to run LaZagne
on an already‑exploited host. Pupy is also written in Python, and
there's a GitHub repository for it.
There's also a course on Pluralsight named Command and Control with Pupy,
which I can recommend you take a look at.
So how do we limit the risk from a tool like LaZagne?
We're very much reliant on credentials in their various forms.
Those credentials are often spread quite widely around a computer,
creating a large attack surface for a tool like LaZagne to take
advantage of. The tools that store credentials often don't
specialize in keeping them safe. When we look at defense, it's wise
to reduce that potential attack surface.
This can be achieved by using a reputable password manager, which will have
stronger controls than the types of tools that LaZagne targets.
If you're using a strong password to control access to the password manager
and don't have that password lying around on your machine,
then it should help a lot. And that's it.
Hopefully you've found this useful and consider using
LaZagne on future RedTeam engagements.
You can catch me on Twitter @Gav_JL, and feel free to put
thoughts and questions in the comments section for this course
on Pluralsight. Thanks for watching.