HeapLeakDetection, specifically the registry key at HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications, is a powerful forensic artifact for investigating suspicious executables. This key tracks programs that Windows RADAR (Runtime Application Self-healing and Detection At Runtime) flags for memory leak detection.
- 📝 Registry Location:
HKLM\Software\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications - 📊 Contains subkeys for each detected executable
- ⏰ Records
LastDetectionTimefor each detection event - 🔄 Continuously monitors system-wide memory behavior
According to research by Harel Segev, RADAR monitors processes based on several factors:
- 📈 Commits at least 5% of total physical memory (CommitThreshold)
- ⏱️ Checks processes at regular intervals (TimerInterval)
- 🕒 Maintains detection history to prevent duplicate entries
This repository includes a C++ program that demonstrates how to trigger Windows RADAR HeapLeakDetection:
- 💾 Controlled memory allocation in configurable chunks
- 📊 Real-time allocation monitoring
- ⚡ Optimized for RADAR detection
- 🔄 Continuous execution until detection
- Clone this repository
- Build using provided build script or Visual Studio
- Run as administrator
- Monitor registry for detection entry
As highlighted by security researchers, this artifact provides:
- 🕵️ Alternative evidence source when traditional artifacts are missing
- ⏰ Temporal correlation for suspicious executables
- 🧪 Behavioral insights into application memory patterns
- 🛡️ Resilience against common anti-forensic techniques
Contributions are welcome! Please feel free to submit pull requests or open issues for improvements.