Windows LiveKD Driver File Created by Non-LiveKD Executable

Alerts when LiveKdD.SYS is created by a process other than livekd.exe/livek64.exe on Windows.

FreeUnreviewedSigmahighv1

windows-livekd-driver-file-created-by-non-livekd-executable-059c5af9

title: Windows LiveKD Driver File Created by Non-LiveKD Executable
id: 99e05e16-9859-484c-868b-11d269ace071
related:
  - id: 16fe46bb-4f64-46aa-817d-ff7bec4a2352
    type: similar
  - id: 059c5af9-5131-4d8d-92b2-de4ad6146712
    type: derived
status: test
description: This rule flags file creation of the LiveKdD.SYS kernel driver in C:\Windows\System32\drivers\ when the creating process image is not one of the expected LiveKD binaries (livekd.exe or livek64.exe). Attackers may use this to load or prepare kernel-level functionality for stealth or privilege-related activity, making unexpected driver provisioning noteworthy. It relies on Windows file creation telemetry for the driver path and on the creating process image name for exclusion filtering.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_livekd_driver_susp_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename: C:\Windows\System32\drivers\LiveKdD.SYS
  filter_main_legit_name:
    Image|endswith:
      - \livekd.exe
      - \livek64.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrators might rename LiveKD before its usage which could trigger this. Add additional names you use to the filter
level: high
license: DRL-1.1

What it detects

This rule flags file creation of the LiveKdD.SYS kernel driver in C:\Windows\System32\drivers\ when the creating process image is not one of the expected LiveKD binaries (livekd.exe or livek64.exe). Attackers may use this to load or prepare kernel-level functionality for stealth or privilege-related activity, making unexpected driver provisioning noteworthy. It relies on Windows file creation telemetry for the driver path and on the creating process image name for exclusion filtering.

Known false positives

Administrators might rename LiveKD before its usage which could trigger this. Add additional names you use to the filter

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.