Detection rules › Splunk
RdrLeakDiag.exe Memory Dump (Sysmon)
rdrleakdiag.exe is a Windows diagnostic tool used to detect and analyze memory leaks. Threat actors may abuse rdrleakdiag.exe to create memory dumps on a system, potentially extracting sensitive information such as credentials or encryption keys. Sophos reported use of this technique in their Crimson Palace investigation targeting LSASS for credential dumping. This use case detects memory dump commands using rdrleakdiag.exe, accounting for instances where the binary has been renamed
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1003.001 OS Credential Dumping: LSASS Memory |
References
- https://attack.mitre.org/techniques/T1003/001/
- https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/
- https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive/
- https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml
- https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/deprecated/windows/proc_creation_win_lolbin_rdrleakdiag.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-13---dump-lsassexe-using-lolbin-rdrleakdiagexe
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '32860.58327'
title: RdrLeakDiag.exe Memory Dump
description: rdrleakdiag.exe is a Windows diagnostic tool used to detect and analyze
memory leaks. Threat actors may abuse rdrleakdiag.exe to create memory dumps on
a system, potentially extracting sensitive information such as credentials or encryption
keys. Sophos reported use of this technique in their Crimson Palace investigation
targeting LSASS for credential dumping. This use case detects memory dump commands
using rdrleakdiag.exe, accounting for instances where the binary has been renamed.
Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
(("/fullmemdmp" OR "/memdmp" OR "-memdmp") ("-o" OR "/o") AND ("-p" OR "/p")) OR
((TERM(rdrleakdiag) OR "RdrLeakDiag.exe") ("fullmemdmp" OR "/memdmp" OR "-memdmp"))
| table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1003/001/
- https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/
- https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive/
- https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml
- https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/deprecated/windows/proc_creation_win_lolbin_rdrleakdiag.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-13---dump-lsassexe-using-lolbin-rdrleakdiagexe
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") (("/fullmemdmp" OR "/memdmp" OR "-memdmp") ("-o" OR "/o") AND ("-p" OR "/p")) OR ((TERM(rdrleakdiag) OR "RdrLeakDiag.exe") ("fullmemdmp" OR "/memdmp" OR "-memdmp"))
Stage 2: table
| table _time, host, user, process, process_*, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "/fullmemdmp" |
| 1 | "/memdmp" |
| 1 | "-memdmp" |
| 1 | "-o" |
| 1 | "/o" |
| 1 | "-p" |
| 1 | "/p" |
| 1 | TERM |
| 1 | rdrleakdiag |
| 1 | "RdrLeakDiag.exe" |
| 1 | "fullmemdmp" |
| 1 | "/memdmp" |
| 1 | "-memdmp" |