Windows Process Creation: LiveKD Execution Suggesting Potential Memory Dumping
Detects launching LiveKD (livekd.exe/livekd64.exe) on Windows via image path or PE OriginalFileName metadata.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-30
What it detects
This rule flags process creation events where LiveKD executables (livekd.exe or livekd64.exe) are launched, using either the image path ending or the OriginalFileName metadata. LiveKD can be used for live troubleshooting and, when abused, may support memory acquisition or dumping activities. The detection relies on Windows process creation telemetry and matches on executable name/path and PE metadata fields.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-livekd-execution-suggesting-potential-memory-dumping-a85f7765
title: "Windows Process Creation: LiveKD Execution Suggesting Potential Memory Dumping"
id: bd95d070-2906-4da0-a075-10b8e1a9153e
status: test
description: This rule flags process creation events where LiveKD executables (livekd.exe or livekd64.exe) are launched, using either the image path ending or the OriginalFileName metadata. LiveKD can be used for live troubleshooting and, when abused, may support memory acquisition or dumping activities. The detection relies on Windows process creation telemetry and matches on executable name/path and PE metadata fields.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- \livekd.exe
- \livekd64.exe
- OriginalFileName: livekd.exe
condition: selection
falsepositives:
- Administration and debugging activity (must be investigated)
level: medium
license: DRL-1.1
related:
- id: a85f7765-698a-4088-afa0-ecfbf8d01fa4
type: derived