Identifier / Programs / Windows
rdrleakdiag.exe
Microsoft Windows Resource Leak Diagnostic file version info (xCyclopedia)
LOLBAS Dump 1 Sigma rule name it 2 ATT&CK techniques 3 documented commands 10 known copies with hashes
How rdrleakdiag.exe is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for rdrleakdiag.exe.
3 documented commands
Dump T1003 OS Credential Dumping User privileges
Dump process by PID and create a dump file (creates files called minidump_<PID>.dmp and results_<PID>.hlk).
rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1Trips 1 Sigma rule: highProcess Memory Dump via RdrLeakDiag.EXE by Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Dump T1003.001 OS Credential Dumping: LSASS Memory Administrator privileges
Dump LSASS process by PID and create a dump file (creates files called minidump_<PID>.dmp and results_<PID>.hlk).
rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1Trips 1 Sigma rule: highProcess Memory Dump via RdrLeakDiag.EXE by Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Dump T1003.001 OS Credential Dumping: LSASS Memory Administrator privileges
After dumping a process using /wait 1, subsequent dumps must use /snap (creates files called minidump_<PID>.dmp and results_<PID>.hlk).
rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /snapTrips 1 Sigma rule: highProcess Memory Dump via RdrLeakDiag.EXE by Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
All 3 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for rdrleakdiag.exe, by John Dwyer, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for rdrleakdiag.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real rdrleakdiag.exe?
C:\Windows\system32\C:\Windows\SysWOW64\10 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rdrleakdiag.exe · signed by Microsoft Windows
fa188d19e59304fd1968fc14cec679238d569fb535679bd067130eaf29164b5b10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdrleakdiag.exe · signed by Microsoft Windows
fcc8cbd3167f09bf585f7f611ef2fc720b8697e2eefb4154bb2370c681a1865110.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rdrleakdiag.exe · signed by Microsoft Windows
420797c47485edb779e4adc7445f12ce4c16ba310bcc9562492798e58eba335210.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdrleakdiag.exe · signed by Microsoft Windows
d66e1ee7970598a5f34fd4b468b5b7705219e80a8a2784e7b18564831fca797c10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdrleakdiag.exe · signed by Microsoft Windows
886f96d3c5eb4dd553ba71d8c32e3182bd1d0862b260a30d1136c232a7004ca310.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rdrleakdiag.exe · signed by Microsoft Windows
8c73fc8ef3a3920033dbd98471659761b401697cd3f1be743be650e480876b2510.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rdrleakdiag.exe · signed by Microsoft Windows
20ade22fa45a4bf6c0ef5c17b21e9661db6aac6968aed663349b27c4f302196110.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rdrleakdiag.exe · signed by Microsoft Windows
541a5e886e9d9767e66e8925d9c93c67ae5a01637a1826a6e34fb23cc658738710.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rdrleakdiag.exe · signed by Microsoft Windows
c0a93b823c51e26d4b00fef2ba8fc7f84abc096db29838cf30bbe0cdee2f90c310.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rdrleakdiag.exe · signed by Microsoft Windows
cfdb4dddf8e024b38012cf753e45837e9d3c1d7f4dcbbd75cdcf1b9565cc41baFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.