LOLBin process memory dump
A signed Microsoft diagnostic tool used to write another process's memory to disk.
What it detects
A signed Microsoft diagnostic tool used to write another process's memory to disk. Each of these ships with Windows or with a Microsoft product and is signed, so it passes application control and rarely appears on an allow-list of "credential dumping tools" — which is exactly why operators reach for them instead of bringing their own dumper.
* rdrleakdiag /fullmemdmp — Resource Leak Diagnostic * procdump -ma — Sysinternals * sqldumper.exe ... 0x01100 — ships with SQL Server and Office * createdump.exe — the .NET runtime's dump tool * tttracer.exe — Time Travel Debugging * werfault.exe -pd — Windows Error Reporting, driven manually
If the target is LSASS the result is the credential material of every account on the host; if it is another process, it is still an unusual amount of interest in that process's memory.
MITRE ATT&CK mapping
- T1003.001OS Credential Dumping: LSASS Memory· Credential Access
False positives and triage
All of these have genuine diagnostic uses. procdump -ma in particular is a standard step when a developer or a Microsoft support engineer is investigating a crash or a hang, and createdump runs as part of normal .NET fault handling.
To confirm: identify the TARGET process. A dump of lsass.exe is credential theft and needs no further debate; a dump of an application that was genuinely misbehaving, taken by an administrator during a support case, is not. Then look at where the output went — a diagnostic dump lands in a temp or support directory and gets sent to a vendor, while an attacker's lands on the Desktop, in \ProgramData, or somewhere staged for exfiltration. Recover the dump file: while it exists, the credentials in it are still extractable by anyone who obtains it.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/lolbin_process_memory_dump.yaml, licensed under the Apache License 2.0.
id: windows.credential.lolbin_process_memory_dump
version: 1.0.0
status: stable
severity: critical
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1003.001]
description: |
A signed Microsoft diagnostic tool used to write another process's memory to disk.
Each of these ships with Windows or with a Microsoft product and is signed, so it
passes application control and rarely appears on an allow-list of "credential
dumping tools" — which is exactly why operators reach for them instead of
bringing their own dumper.
* `rdrleakdiag /fullmemdmp` — Resource Leak Diagnostic
* `procdump -ma` — Sysinternals
* `sqldumper.exe ... 0x01100` — ships with SQL Server and Office
* `createdump.exe` — the .NET runtime's dump tool
* `tttracer.exe` — Time Travel Debugging
* `werfault.exe -pd` — Windows Error Reporting, driven manually
If the target is LSASS the result is the credential material of every account on
the host; if it is another process, it is still an unusual amount of interest in
that process's memory.
match:
command_line_regex: '(?i)(rdrleakdiag(\.exe)?"?\s[^|]*/fullmemdmp|procdump(64)?(\.exe)?"?\s[^|]*-ma\s|sqldumper(\.exe)?"?\s[^|]*0x0?1100|createdump(\.exe)?"?\s|tttracer(\.exe)?"?\s[^|]*-dumpfull|werfault(\.exe)?"?\s[^|]*-pd\s)'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
All of these have genuine diagnostic uses. `procdump -ma` in particular is a
standard step when a developer or a Microsoft support engineer is investigating a
crash or a hang, and `createdump` runs as part of normal .NET fault handling.
To confirm: identify the TARGET process. A dump of `lsass.exe` is credential theft
and needs no further debate; a dump of an application that was genuinely
misbehaving, taken by an administrator during a support case, is not. Then look at
where the output went — a diagnostic dump lands in a temp or support directory and
gets sent to a vendor, while an attacker's lands on the Desktop, in `\ProgramData`,
or somewhere staged for exfiltration. Recover the dump file: while it exists, the
credentials in it are still extractable by anyone who obtains it.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.