Process Memory Dump via RdrLeakDiag.EXE
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory. This tool, while legitimate, can be abused by adversaries to extract sensitive information, such as credentials, from process memory. The rule specifically looks for the execution of rdrleakdiag.exe with command-line arguments indicative of memory dumping, such as '/memdmp' or 'fullmemdmp', along with output and process specification arguments.
Sigma
