Windows Process Creation of Kernel Debugger kd.exe
Flags Windows process creations that run kd.exe using image path and OriginalFileName metadata.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-31
What it detects
This rule flags process creation events where the executed binary is Windows Kernel Debugger kd.exe, identified by image path ending with \kd.exe or an OriginalFileName of kd.exe. Attackers may use kernel debugging tools to facilitate stealthy access, troubleshooting, or misuse of privileged functionality. The detection relies on process creation telemetry with both the process image path and the OriginalFileName field.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-execution-of-kd-exe-windows-kernel-debugger-27ee9438
title: Windows Process Creation of Kernel Debugger kd.exe
id: 212aedcb-1244-47f8-b9ab-9c8c5c92e273
status: test
description: This rule flags process creation events where the executed binary is Windows Kernel Debugger kd.exe, identified by image path ending with \kd.exe or an OriginalFileName of kd.exe. Attackers may use kernel debugging tools to facilitate stealthy access, troubleshooting, or misuse of privileged functionality. The detection relies on process creation telemetry with both the process image path and the OriginalFileName field.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_kd_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2024-04-24
tags:
- attack.privilege-escalation
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \kd.exe
- OriginalFileName: kd.exe
condition: selection
falsepositives:
- Rare occasions of legitimate cases where kernel debugging is necessary in production. Investigation is required
level: medium
license: DRL-1.1
related:
- id: 27ee9438-90dc-4bef-904b-d3ef927f5e7e
type: derived