Windows Kernel Debugger (kd.exe) Execution
This rule detects the execution of the Windows Kernel Debugger, 'kd.exe'. While kernel debuggers are legitimate tools, their execution in a production environment can indicate attempts at defense evasion, privilege escalation, or in-depth system analysis by an adversary. The rule specifically looks for the executable name 'kd.exe' either in the image path or the original file name.
Sigma
