sigmahighHunting

LiveKD Kernel Memory Dump File Created

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

Detection Query

selection:
  TargetFilename: C:\Windows\livekd.dmp
condition: selection

Author

Nasreddine Bencherchali (Nextron Systems)

Created

2023-05-16

Data Sources

windowsFile Events

Platforms

windows

References

Internal Research

Tags

attack.defense-evasionattack.privilege-escalation

Raw Content

title: LiveKD Kernel Memory Dump File Created
id: 814ddeca-3d31-4265-8e07-8cc54fb44903
status: test
description: Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-16
tags:
    - attack.defense-evasion
    - attack.privilege-escalation
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename: 'C:\Windows\livekd.dmp'
    condition: selection
falsepositives:
    - In rare occasions administrators might leverage LiveKD to perform live kernel debugging. This should not be allowed on production systems. Investigate and apply additional filters where necessary.
level: high