Windows LiveKD Driver Creation via LiveKdD.SYS and LiveKD Executable Launch
Detects creation of LiveKdD.SYS in the Windows drivers directory by LiveKD executables.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-16
- Updated
- 2026-07-31
What it detects
This rule flags file activity consistent with creating the LiveKD kernel debugging driver at C:\Windows\System32\drivers\LiveKdD.SYS when the initiating process is livekd.exe or livek64.exe. Attackers may use LiveKD to gain capabilities for live kernel debugging and potential stealth during privileged operations. It relies on Windows file event telemetry capturing the target driver path and the creating process executable name.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-livekd-driver-file-creation-via-livekd-exe-or-livek64-exe-16fe46bb
title: Windows LiveKD Driver Creation via LiveKdD.SYS and LiveKD Executable Launch
id: cf182017-3339-4511-a48d-baa42f10a4a5
status: test
description: This rule flags file activity consistent with creating the LiveKD kernel debugging driver at C:\Windows\System32\drivers\LiveKdD.SYS when the initiating process is livekd.exe or livek64.exe. Attackers may use LiveKD to gain capabilities for live kernel debugging and potential stealth during privileged operations. It relies on Windows file event telemetry capturing the target driver path and the creating process executable name.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_livekd_driver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
tags:
- attack.privilege-escalation
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename: C:\Windows\System32\drivers\LiveKdD.SYS
Image|endswith:
- \livekd.exe
- \livek64.exe
condition: selection
falsepositives:
- Legitimate usage of LiveKD for debugging purposes will also trigger this
level: medium
license: DRL-1.1
related:
- id: 16fe46bb-4f64-46aa-817d-ff7bec4a2352
type: derived