Record a3e0e94c34732d4a99465b48 · v1
Schema CheckedNot runtime validated
lazagne
Source repository hunting query
Generation sourcesource-file · Limited verification
Attributionmicrosoft
Last updated10 Sept 2020, 06:04 AM IST
Last checked17 Oct 2026
Kusto query · 9 linesTable: DeviceProcessEvents · Microsoft Defender XDR / Sentinel
// Find credential theft via SAM database export by LaZagneDeviceProcessEvents| where Timestamp > ago(7d)| where FileName =~ 'reg.exe' and ProcessCommandLine has 'save' and ProcessCommandLine has 'hklm' and ProcessCommandLine has 'sam'| project DeviceId, Timestamp, InitiatingProcessId, InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLineSecOps Signal does not execute queries against private telemetry. Paste the query into Microsoft Sentinel Log Analytics or Defender advanced hunting and review it first. Passed structure and schema checks; tenant execution is not verified.
Query anatomy
Static check against a reviewed column list| Column | Table | In reviewed schema list |
|---|---|---|
| DeviceId | DeviceProcessEvents | Listed |
| Timestamp | DeviceProcessEvents | Listed |
| InitiatingProcessId | DeviceProcessEvents | Listed |
| InitiatingProcessFileName | DeviceProcessEvents | Listed |
| ProcessId | DeviceProcessEvents | Listed |
| FileName | DeviceProcessEvents | Listed |
| ProcessCommandLine | DeviceProcessEvents | Listed |
“Listed” only means the column name appears in the reviewed list for that table. It does not confirm the column exists in your tenant's current schema, and per-column purposes are not recorded.
Hunting notes
MITRE ATT&CKNot mapped
Analytical purpose
Source repository hunting query
When to use
Review the source query and adapt it to your tenant before use.
Limitations
Schema checked only. This query has not been executed against a Sentinel or Defender tenant.