title: Process Dump via RdrLeakDiag.exe
id: edadb1e5-5919-4e4c-8462-a9e643b02c4b 
description: Detects a process memory dump performed by RdrLeakDiag.exe
status: experimental
level: high
references:
    - https://www.pureid.io/dumping-abusing-windows-credentials-part-1/
author: Cedric MAURUGEON
date: 2021/09/24
tags:
    - attack.credential_access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        OriginalFileName: RdrLeakDiag.exe
        CommandLine|contains: fullmemdmp
    condition: selection
falsepositives: 
    - Unknown
