Windows Process Creation: LiveKD Execution Suggesting Potential Memory Dumping

Detects launching LiveKD (livekd.exe/livekd64.exe) on Windows via image path or PE OriginalFileName metadata.

FreeUnreviewedSigmamediumv1

windows-process-creation-livekd-execution-suggesting-potential-memory-dumping-a85f7765

title: "Windows Process Creation: LiveKD Execution Suggesting Potential Memory Dumping"
id: bd95d070-2906-4da0-a075-10b8e1a9153e
status: test
description: This rule flags process creation events where LiveKD executables (livekd.exe or livekd64.exe) are launched, using either the image path ending or the OriginalFileName metadata. LiveKD can be used for live troubleshooting and, when abused, may support memory acquisition or dumping activities. The detection relies on Windows process creation telemetry and matches on executable name/path and PE metadata fields.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \livekd.exe
        - \livekd64.exe
    - OriginalFileName: livekd.exe
  condition: selection
falsepositives:
  - Administration and debugging activity (must be investigated)
level: medium
license: DRL-1.1
related:
  - id: a85f7765-698a-4088-afa0-ecfbf8d01fa4
    type: derived

What it detects

This rule flags process creation events where LiveKD executables (livekd.exe or livekd64.exe) are launched, using either the image path ending or the OriginalFileName metadata. LiveKD can be used for live troubleshooting and, when abused, may support memory acquisition or dumping activities. The detection relies on Windows process creation telemetry and matches on executable name/path and PE metadata fields.

Known false positives

Administration and debugging activity (must be investigated)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.