Process Memory Dump via RdrLeakDiag.EXE

Title: Process Memory Dump via RdrLeakDiag.EXE
Status: test
Description:Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory
References:
  -https://www.pureid.io/dumping-abusing-windows-credentials-part-1/
  -https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  -https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/
  -https://twitter.com/0gtweet/status/1299071304805560321?s=21
  -https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive
Author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-09-24
modified:2024-08-15
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\rdrleakdiag.exe' OriginalFileName:'RdrLeakDiag.exe'   selection_cli_dump:
    CommandLine|contains|windash:
      -'/memdmp'
      -'fullmemdmp'

  selection_cli_output_process:
    CommandLine|contains|windash:
      -' /o '
      -' /p '

  condition:all of selection_*
Falsepositives:
  -Unlikely
Level: high