Windows LiveKD driver file creation via livekd.exe or livek64.exe

Detects creation of LiveKdD.SYS in the Windows drivers directory by LiveKD executables.

FreeUnreviewedSigmamediumv1

windows-livekd-driver-file-creation-via-livekd-exe-or-livek64-exe-16fe46bb

title: Windows LiveKD driver file creation via livekd.exe or livek64.exe
id: cf182017-3339-4511-a48d-baa42f10a4a5
status: test
description: This rule flags creation of the LiveKdD.SYS driver in C:\Windows\System32\drivers when the creating process is livekd.exe or livek64.exe. Attackers may use LiveKD to enable live kernel debugging while operating in a stealthy manner and with elevated capabilities. It relies on Windows file event telemetry that records the target driver path and the process image that created the file.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_livekd_driver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename: C:\Windows\System32\drivers\LiveKdD.SYS
    Image|endswith:
      - \livekd.exe
      - \livek64.exe
  condition: selection
falsepositives:
  - Legitimate usage of LiveKD for debugging purposes will also trigger this
level: medium
license: DRL-1.1
related:
  - id: 16fe46bb-4f64-46aa-817d-ff7bec4a2352
    type: derived

What it detects

This rule flags creation of the LiveKdD.SYS driver in C:\Windows\System32\drivers when the creating process is livekd.exe or livek64.exe. Attackers may use LiveKD to enable live kernel debugging while operating in a stealthy manner and with elevated capabilities. It relies on Windows file event telemetry that records the target driver path and the process image that created the file.

Known false positives

Legitimate usage of LiveKD for debugging purposes will also trigger this

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.