Windows LiveKD Kernel Memory Dump Attempt via "-m" Flag
Flags LiveKD executions with the "-m" option that may trigger kernel memory dumping on Windows.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-16
- Updated
- 2026-07-30
What it detects
This rule identifies execution of Sysinternals LiveKD (livekd.exe or livekd64.exe) when the command line includes the "-m" flag, which can be used to dump kernel memory. Dumping kernel memory can expose sensitive data and may be used for stealthy credential or forensic discovery by an attacker. It relies on process creation telemetry capturing the executable path/name and full command line arguments on Windows.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sysinternals/downloads/livekd
- 4sysops.comhttps://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/
- kb.acronis.comhttps://kb.acronis.com/content/60892
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-livekd-kernel-memory-dump-attempt-via-m-flag-c7746f1c
title: Windows LiveKD Kernel Memory Dump Attempt via "-m" Flag
id: 85bfbe57-8624-49fe-84b4-7b816a4efa54
status: test
description: This rule identifies execution of Sysinternals LiveKD (livekd.exe or livekd64.exe) when the command line includes the "-m" flag, which can be used to dump kernel memory. Dumping kernel memory can expose sensitive data and may be used for stealthy credential or forensic discovery by an attacker. It relies on process creation telemetry capturing the executable path/name and full command line arguments on Windows.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
- https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/
- https://kb.acronis.com/content/60892
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
modified: 2024-03-13
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \livekd.exe
- \livekd64.exe
- OriginalFileName: livekd.exe
selection_cli:
CommandLine|contains|windash: " -m"
condition: all of selection_*
falsepositives:
- Unlikely in production environment
level: high
license: DRL-1.1
related:
- id: c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2
type: derived