Windows Process Creation: Suspicious Kernel Dump via dtrace.exe lkd(0) and syscall:::return

Alerts on Windows process executions of dtrace.exe with command lines consistent with kernel dumping (lkd).

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-12-28
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where dtrace.exe is invoked with command-line arguments consistent with attempting to dump the kernel (e.g., lkd(0)). Attackers may use kernel dumping or debugging interfaces to extract sensitive in-memory data or support further exploitation. Detection relies on process creation telemetry, matching dtrace.exe execution and specific command-line patterns indicative of the dump technique.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Suspicious System Profiler Hardware Enumeration (via process_creation)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

Suspicious Security Policy Export via SecEdit (via process_creation)

Windows Process Creation: Suspicious Kernel Dump via dtrace.exe lkd(0) and syscall:::return

Pivot detection · T1082 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-kernel-dump-via-dtrace-exe-lkd-process-creation-7124aebe

title: "Windows Process Creation: Suspicious Kernel Dump via dtrace.exe lkd(0) and syscall:::return"
id: 829cbd09-3e33-49b9-9630-0b106cdf3448
status: test
description: This rule flags Windows process creation events where dtrace.exe is invoked with command-line arguments consistent with attempting to dump the kernel (e.g., lkd(0)). Attackers may use kernel dumping or debugging interfaces to extract sensitive in-memory data or support further exploitation. Detection relies on process creation telemetry, matching dtrace.exe execution and specific command-line patterns indicative of the dump technique.
references:
  - https://twitter.com/0gtweet/status/1474899714290208777?s=12
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-28
tags:
  - attack.discovery
  - attack.t1082
logsource:
  product: windows
  category: process_creation
detection:
  selection_plain:
    Image|endswith: \dtrace.exe
    CommandLine|contains: lkd(0)
  selection_obfuscated:
    CommandLine|contains|all:
      - syscall:::return
      - lkd(
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump/info.yml
license: DRL-1.1
related:
  - id: 7124aebe-4cd7-4ccb-8df0-6d6b93c96795
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL