huntrule

Windows: LiveKD kernel memory dump file creation (livekd.dmp)

Flags creation of C:\Windows\livekd.dmp, a default LiveKD kernel memory dump file name.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-16
Updated
2026-07-31
AnalysisDetection
title: "Windows: LiveKD kernel memory dump file creation (livekd.dmp)"
id: d9559678-b14b-4202-bf50-884396c8531f
status: test
description: This rule flags the creation of the default LiveKD kernel memory dump file by matching the full path to C:\Windows\livekd.dmp. Attackers may use kernel memory dumping to extract sensitive information or support stealthy post-exploitation. The detection relies on Windows file creation telemetry that records the target filename/path for the event.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_livekd_default_dump_name.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-16
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename: C:\Windows\livekd.dmp
  condition: selection
falsepositives:
  - In rare occasions administrators might leverage LiveKD to perform live kernel debugging. This should not be allowed on production systems. Investigate and apply additional filters where necessary.
level: high
license: DRL-1.1
related:
  - id: 814ddeca-3d31-4265-8e07-8cc54fb44903
    type: derived