Windows Process Memory Dump Using RdrLeakDiag.exe (/memdmp|fullmemdmp)
Alerts on Windows executions of rdrleakdiag.exe that request full or targeted memory dumps via /memdmp or /fullmemdmp.
- Product
- windows
- Category
- process_creation
- Author
- Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-09-24
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of the Microsoft Windows Resource Leak Diagnostic tool (rdrleakdiag.exe) with command-line arguments that request a process memory dump. Attackers can use memory dump functionality to extract sensitive data such as credentials from running processes. The detection relies on process creation telemetry, matching the binary name and specific command-line options (/memdmp or fullmemdmp, plus output/process parameters).
Reporting behind it
- pureid.iohttps://www.pureid.io/dumping-abusing-windows-credentials-part-1/
- crowdstrike.comhttps://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/
- twitter.comhttps://twitter.com/0gtweet/status/1299071304805560321?s=21
- news.sophos.comhttps://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Memory Dump Using RdrLeakDiag.exe (/memdmp|fullmemdmp)
id: 5c227ebf-60b2-4bc3-937d-3d3daaef30c5
related:
- id: 6355a919-2e97-4285-a673-74645566340d
type: obsolete
- id: edadb1e5-5919-4e4c-8462-a9e643b02c4b
type: derived
status: test
description: This rule flags execution of the Microsoft Windows Resource Leak Diagnostic tool (rdrleakdiag.exe) with command-line arguments that request a process memory dump. Attackers can use memory dump functionality to extract sensitive data such as credentials from running processes. The detection relies on process creation telemetry, matching the binary name and specific command-line options (/memdmp or fullmemdmp, plus output/process parameters).
references:
- https://www.pureid.io/dumping-abusing-windows-credentials-part-1/
- https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
- https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/
- https://twitter.com/0gtweet/status/1299071304805560321?s=21
- https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml
author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-09-24
modified: 2024-08-15
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rdrleakdiag.exe
- OriginalFileName: RdrLeakDiag.exe
selection_cli_dump:
CommandLine|contains|windash:
- /memdmp
- fullmemdmp
selection_cli_output_process:
CommandLine|contains|windash:
- " /o "
- " /p "
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1