Skip to content

LIVING OFF THE LAND / OS BINARIES

rdrleakdiag.exe

Microsoft Windows resource leak diagnostic tool

03COMMAND EXAMPLES

02ATT&CK TECHNIQUES

03DETECTION RESOURCES

01CAPABILITIES

01 / TRADECRAFT

Command reference

3 examples

Dump3

EXAMPLE 01T1003

Dump process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).

COMMAND

rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

USE CASE: Dump process by PID.
PRIVILEGES: User
OPERATING SYSTEM: Windows

EXAMPLE 02T1003.001

Dump LSASS process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).

COMMAND

rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

USE CASE: Dump LSASS process.
PRIVILEGES: Administrator
OPERATING SYSTEM: Windows

EXAMPLE 03T1003.001

After dumping a process using `/wait 1`, subsequent dumps must use `/snap` (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`).

COMMAND

rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /snap

USE CASE: Dump LSASS process mutliple times.
PRIVILEGES: Administrator
OPERATING SYSTEM: Windows

02 / ON DISK

Known paths

c:\windows\system32\rdrleakdiag.exe

c:\Windows\SysWOW64\rdrleakdiag.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Grzegorz Tworek@0gtweet