Skip to content

Create RADARHeapLeakDetection.yaml - #1270

Open
dciftci wants to merge 2 commits into
Velocidex:masterfrom
dciftci:patch-3
Open

Create RADARHeapLeakDetection.yaml#1270
dciftci wants to merge 2 commits into
Velocidex:masterfrom
dciftci:patch-3

Conversation

@dciftci

@dciftci dciftci commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

Adds a RADAR (Resource Exhaustion Detection and Resolution) HeapLeakDetection artifact for Windows. Reads HKLM\Software\Microsoft\RADAR\HeapLeakDetection\ DiagnosedApplications and decodes each LastDetectionTime . It is a lesser-known evidence-of-execution artifact, useful as a Prefetch substitute on servers.

Adds a RADAR (Resource Exhaustion Detection and Resolution) HeapLeakDetection
artifact for Windows. Reads HKLM\Software\Microsoft\RADAR\HeapLeakDetection\
DiagnosedApplications and decodes each LastDetectionTime . It is a lesser-known evidence-of-execution artifact, useful as a
Prefetch substitute on servers.
@scudette

scudette commented Jun 8, 2026

Copy link
Copy Markdown
Collaborator

@dciftci

dciftci commented Jun 8, 2026

Copy link
Copy Markdown
Contributor Author

Ah yes. it is already covered by this rule.
I just wanted to create a particular new rule for the artifact exchange

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants