Windows: LiveKD kernel memory dump file creation (livekd.dmp)
Flags creation of C:\Windows\livekd.dmp, a default LiveKD kernel memory dump file name.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-16
- Updated
- 2026-07-31
What it detects
This rule flags the creation of the default LiveKD kernel memory dump file by matching the full path to C:\Windows\livekd.dmp. Attackers may use kernel memory dumping to extract sensitive information or support stealthy post-exploitation. The detection relies on Windows file creation telemetry that records the target filename/path for the event.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-livekd-kernel-memory-dump-file-created-livekd-dmp-814ddeca
title: "Windows: LiveKD kernel memory dump file creation (livekd.dmp)"
id: d9559678-b14b-4202-bf50-884396c8531f
status: test
description: This rule flags the creation of the default LiveKD kernel memory dump file by matching the full path to C:\Windows\livekd.dmp. Attackers may use kernel memory dumping to extract sensitive information or support stealthy post-exploitation. The detection relies on Windows file creation telemetry that records the target filename/path for the event.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_livekd_default_dump_name.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
tags:
- attack.privilege-escalation
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename: C:\Windows\livekd.dmp
condition: selection
falsepositives:
- In rare occasions administrators might leverage LiveKD to perform live kernel debugging. This should not be allowed on production systems. Investigate and apply additional filters where necessary.
level: high
license: DRL-1.1
related:
- id: 814ddeca-3d31-4265-8e07-8cc54fb44903
type: derived