Process Memory Dump via RdrLeakDiag.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Process Memory Dump via RdrLeakDiag.EXE
id: edadb1e5-5919-4e4c-8462-a9e643b02c4b
related:
    - id: 6355a919-2e97-4285-a673-74645566340d
      type: obsolete
status: test
description: Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory
references:
    - https://www.pureid.io/dumping-abusing-windows-credentials-part-1/
    - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
    - https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/
    - https://twitter.com/0gtweet/status/1299071304805560321?s=21
    - https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive
author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
date: 2021-09-24
modified: 2024-08-15
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\rdrleakdiag.exe'
        - OriginalFileName: RdrLeakDiag.exe
    selection_cli_dump:
        CommandLine|contains|windash:
            - '/memdmp'
            - 'fullmemdmp'
    selection_cli_output_process:
        CommandLine|contains|windash:
            - ' /o ' # Output
            - ' /p ' # Process
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\rdrleakdiag.exe'
    - OriginalFileName: RdrLeakDiag.exe

Stage 2: `selection_cli_dump`

selection_cli_dump:
    CommandLine|contains|windash:
        - '/memdmp'
        - 'fullmemdmp'

Stage 3: `selection_cli_output_process`

selection_cli_output_process:
    CommandLine|contains|windash:
        - ' /o '
        - ' /p '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/o` transforms: `windash` corpus 2 (sigma 2) `/p` transforms: `windash` `/memdmp` transforms: `windash` `fullmemdmp` transforms: `windash`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\rdrleakdiag.exe`	`field:"Image" kind:ends_with value:"\rdrleakdiag.exe"`
`OriginalFileName`	eq	`RdrLeakDiag.exe` corpus 3 (elastic 2, sigma 1)	`field:"OriginalFileName" kind:eq value:"RdrLeakDiag.exe"`

Process Memory Dump via RdrLeakDiag.EXE

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli_dump

Stage 3: selection_cli_output_process

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli_dump`

Stage 3: `selection_cli_output_process`