Detection rules › Sigma
LiveKD Driver Creation By Uncommon Process
Detects the creation of the LiveKD driver by a process image other than "livekd.exe".
Known false positives
- Administrators might rename LiveKD before its usage which could trigger this. Add additional names you use to the filter
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | No specific technique |
| Stealth | No specific technique |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule body
title: LiveKD Driver Creation By Uncommon Process
id: 059c5af9-5131-4d8d-92b2-de4ad6146712
related:
- id: 16fe46bb-4f64-46aa-817d-ff7bec4a2352
type: similar
status: test
description: Detects the creation of the LiveKD driver by a process image other than "livekd.exe".
references:
- Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-16
tags:
- attack.privilege-escalation
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename: 'C:\Windows\System32\drivers\LiveKdD.SYS'
filter_main_legit_name:
Image|endswith:
- '\livekd.exe'
- '\livek64.exe'
condition: selection and not 1 of filter_main_*
falsepositives:
- Administrators might rename LiveKD before its usage which could trigger this. Add additional names you use to the filter
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
TargetFilename: 'C:\Windows\System32\drivers\LiveKdD.SYS'
Stage 2: not filter_main_legit_name
filter_main_legit_name:
Image|endswith:
- '\livekd.exe'
- '\livek64.exe'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \livek64.exe | excludes:Image field:"Image" value:"\livek64.exe" |
Image | ends_with | \livekd.exe | excludes:Image field:"Image" value:"\livekd.exe" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | eq |
| field:"TargetFilename" kind:eq value:"C:\Windows\System32\drivers\LiveKdD.SYS" |