Windows LiveKD Kernel Memory Dump File Created (livekd.dmp)

Flags creation of C:\Windows\livekd.dmp, a default LiveKD kernel memory dump file name.

FreeUnreviewedSigmahighv1

windows-livekd-kernel-memory-dump-file-created-livekd-dmp-814ddeca

title: Windows LiveKD Kernel Memory Dump File Created (livekd.dmp)
id: d9559678-b14b-4202-bf50-884396c8531f
status: test
description: This rule detects creation of a Windows file named C:\Windows\livekd.dmp, matching the default LiveKD kernel memory dump filename. Attackers can use kernel memory dump artifacts to obtain sensitive in-memory data and support stealthy post-exploitation or analysis. It relies on Windows file creation telemetry that records the target filename for file events.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_livekd_default_dump_name.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename: C:\Windows\livekd.dmp
  condition: selection
falsepositives:
  - In rare occasions administrators might leverage LiveKD to perform live kernel debugging. This should not be allowed on production systems. Investigate and apply additional filters where necessary.
level: high
license: DRL-1.1
related:
  - id: 814ddeca-3d31-4265-8e07-8cc54fb44903
    type: derived

What it detects

This rule detects creation of a Windows file named C:\Windows\livekd.dmp, matching the default LiveKD kernel memory dump filename. Attackers can use kernel memory dump artifacts to obtain sensitive in-memory data and support stealthy post-exploitation or analysis. It relies on Windows file creation telemetry that records the target filename for file events.

Known false positives

In rare occasions administrators might leverage LiveKD to perform live kernel debugging. This should not be allowed on production systems. Investigate and apply additional filters where necessary.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.