Windows Process Memory Dump Using RdrLeakDiag.exe (/memdmp|fullmemdmp)

title: Windows Process Memory Dump Using RdrLeakDiag.exe (/memdmp|fullmemdmp)
id: 5c227ebf-60b2-4bc3-937d-3d3daaef30c5
related:
  - id: 6355a919-2e97-4285-a673-74645566340d
    type: obsolete
  - id: edadb1e5-5919-4e4c-8462-a9e643b02c4b
    type: derived
status: test
description: This rule flags execution of the Microsoft Windows Resource Leak Diagnostic tool (rdrleakdiag.exe) with command-line arguments that request a process memory dump. Attackers can use memory dump functionality to extract sensitive data such as credentials from running processes. The detection relies on process creation telemetry, matching the binary name and specific command-line options (/memdmp or fullmemdmp, plus output/process parameters).
references:
  - https://www.pureid.io/dumping-abusing-windows-credentials-part-1/
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/
  - https://twitter.com/0gtweet/status/1299071304805560321?s=21
  - https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml
author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-09-24
modified: 2024-08-15
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rdrleakdiag.exe
    - OriginalFileName: RdrLeakDiag.exe
  selection_cli_dump:
    CommandLine|contains|windash:
      - /memdmp
      - fullmemdmp
  selection_cli_output_process:
    CommandLine|contains|windash:
      - " /o "
      - " /p "
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1