rdrleakdiag.exe

Dump process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).

Use Dump process by PID.

rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Dump

MITRE

T1003

Detection

Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml

Elastic: www.elastic.co/guide/en/security/current/potential-credential-access-via-windows-utilities.html

Elastic: github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml

Refs

twitter.com/0gtweet/status/1299071304805560321?s=21

www.pureid.io/dumping-abusing-windows-credentials-part-1/

github.com/LOLBAS-Project/LOLBAS/issues/84

lolbas-project.github.io/lolbas/Binaries/rdrleakdiag/

Dump LSASS process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).

Use Dump LSASS process.

rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Dump

MITRE

T1003.001

Detection

Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml

Elastic: www.elastic.co/guide/en/security/current/potential-credential-access-via-windows-utilities.html

Elastic: github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml

Refs

twitter.com/0gtweet/status/1299071304805560321?s=21

www.pureid.io/dumping-abusing-windows-credentials-part-1/

github.com/LOLBAS-Project/LOLBAS/issues/84

lolbas-project.github.io/lolbas/Binaries/rdrleakdiag/

After dumping a process using `/wait 1`, subsequent dumps must use `/snap` (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).

Use Dump LSASS process mutliple times.

rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /snap

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Dump

MITRE

T1003.001

Detection

Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml

Elastic: www.elastic.co/guide/en/security/current/potential-credential-access-via-windows-utilities.html

Elastic: github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml

Refs

twitter.com/0gtweet/status/1299071304805560321?s=21

www.pureid.io/dumping-abusing-windows-credentials-part-1/

github.com/LOLBAS-Project/LOLBAS/issues/84

lolbas-project.github.io/lolbas/Binaries/rdrleakdiag/