Credential Extraction via Grep or LaZagne on macOS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

Detects attempts to extract credentials from files using the 'grep' command to search for the keyword 'password' or by executing the 'laZagne' credential dumping tool. This rule is specifically tailored for macOS environments.