huntrule

Windows LiveKD Kernel Memory Dump Attempt via "-m" Flag

Flags LiveKD executions with the "-m" option that may trigger kernel memory dumping on Windows.

FreeUnreviewedSigmahighv1
title: Windows LiveKD Kernel Memory Dump Attempt via "-m" Flag
id: 85bfbe57-8624-49fe-84b4-7b816a4efa54
status: test
description: This rule identifies execution of Sysinternals LiveKD (livekd.exe or livekd64.exe) when the command line includes the "-m" flag, which can be used to dump kernel memory. Dumping kernel memory can expose sensitive data and may be used for stealthy credential or forensic discovery by an attacker. It relies on process creation telemetry capturing the executable path/name and full command line arguments on Windows.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
  - https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/
  - https://kb.acronis.com/content/60892
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
modified: 2024-03-13
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \livekd.exe
        - \livekd64.exe
    - OriginalFileName: livekd.exe
  selection_cli:
    CommandLine|contains|windash: " -m"
  condition: all of selection_*
falsepositives:
  - Unlikely in production environment
level: high
license: DRL-1.1
related:
  - id: c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2
    type: derived

What it detects

This rule identifies execution of Sysinternals LiveKD (livekd.exe or livekd64.exe) when the command line includes the "-m" flag, which can be used to dump kernel memory. Dumping kernel memory can expose sensitive data and may be used for stealthy credential or forensic discovery by an attacker. It relies on process creation telemetry capturing the executable path/name and full command line arguments on Windows.

Known false positives

  • Unlikely in production environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.