windows enabled community critical v1.0.0

rdrleakdiag

Microsoft Windows resource leak diagnostic tool Located at: c:\windows\system32\rdrleakdiag.exe; c:\Windows\SysWOW64\rdrleakdiag.exe.

📋 Live Preview 
rdrleakdiag
rdrleakdiag

Sandbox: execFile · Timeout: 30s

Capabilities

credential.dump

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Dump process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). (Dump process by PID.)

rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

Dump LSASS process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). (Dump LSASS process.)

rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

After dumping a process using `/wait 1`, subsequent dumps must use `/snap` (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). (Dump LSASS process mutliple times.)

rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /snap

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml
elastic https://www.elastic.co/guide/en/security/current/potential-credential-access-via-windows-utilities.html
elastic https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml

Documentation

rdrleakdiag

rdrleakdiag is a Windows LOLBin. Microsoft Windows resource leak diagnostic tool Located at: c:\windows\system32\rdrleakdiag.exe; c:\Windows\SysWOW64\rdrleakdiag.exe.

References