Potential Memory Dumping Activity Via LiveKD

 1title: Potential Memory Dumping Activity Via LiveKD
 2id: a85f7765-698a-4088-afa0-ecfbf8d01fa4
 3status: test
 4description: Detects execution of LiveKD based on PE metadata or image name
 5references:
 6    - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2023/05/15
 9tags:
10    - attack.defense_evasion
11logsource:
12    category: process_creation
13    product: windows
14detection:
15    selection:
16        - Image|endswith:
17              - '\livekd.exe'
18              - '\livekd64.exe'
19        - OriginalFileName: 'livekd.exe'
20    condition: selection
21falsepositives:
22    - Administration and debugging activity (must be investigated)
23level: medium

References

• LiveKd - Sysinternals

  

  Use Microsoft kernel debuggers to examine a live system.

  
  Read More

Related rules

• Bitsadmin to Uncommon TLD
• Dllhost.EXE Execution Anomaly
• Driver/DLL Installation Via Odbcconf.EXE
• File Download Via Bitsadmin To A Suspicious Target Folder
• File With Suspicious Extension Downloaded Via Bitsadmin