Windows Process Creation: Execution of kd.exe (Windows Kernel Debugger)

Flags Windows process creations that run kd.exe using image path and OriginalFileName metadata.

FreeUnreviewedSigmamediumv1

windows-process-creation-execution-of-kd-exe-windows-kernel-debugger-27ee9438

title: "Windows Process Creation: Execution of kd.exe (Windows Kernel Debugger)"
id: 212aedcb-1244-47f8-b9ab-9c8c5c92e273
status: test
description: This rule identifies process creation events where the executable path ends with kd.exe or where the image reports OriginalFileName as kd.exe. Execution of the Windows Kernel Debugger may be used to inspect or interact with kernel components during debugging or potentially malicious activity. The detection relies on Windows process creation telemetry, including the process image path/name and the OriginalFileName metadata.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_kd_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2024-04-24
tags:
  - attack.privilege-escalation
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \kd.exe
    - OriginalFileName: kd.exe
  condition: selection
falsepositives:
  - Rare occasions of legitimate cases where kernel debugging is necessary in production. Investigation is required
level: medium
license: DRL-1.1
related:
  - id: 27ee9438-90dc-4bef-904b-d3ef927f5e7e
    type: derived

What it detects

This rule identifies process creation events where the executable path ends with kd.exe or where the image reports OriginalFileName as kd.exe. Execution of the Windows Kernel Debugger may be used to inspect or interact with kernel components during debugging or potentially malicious activity. The detection relies on Windows process creation telemetry, including the process image path/name and the OriginalFileName metadata.

Known false positives

Rare occasions of legitimate cases where kernel debugging is necessary in production. Investigation is required

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.