Detectionmediumtest

LiveKD Driver Creation

Detects the creation of the LiveKD driver, which is used for live kernel debugging

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Tue May 1616fe46bb-4f64-46aa-817d-ff7bec4a2352windows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename: 'C:\Windows\System32\drivers\LiveKdD.SYS'
        Image|endswith:
            - '\livekd.exe'
            - '\livek64.exe'
    condition: selection

False Positives

Legitimate usage of LiveKD for debugging purposes will also trigger this

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0004 · Privilege Escalation

Rule Metadata

Rule ID

16fe46bb-4f64-46aa-817d-ff7bec4a2352

Status

test

Level

medium

Type

Detection

Created

Tue May 16

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/file/file_event/file_event_win_sysinternals_livekd_driver.yml

Raw Tags

attack.defense-evasionattack.privilege-escalation

View on GitHub