Potential Memory Dumping Activity Via LiveKD
This rule detects the execution of LiveKD, a Sysinternals tool, based on its executable name or original filename metadata. LiveKD allows users to examine a live system's kernel memory, which can be abused by attackers for memory dumping activities, particularly for credential extraction.
Sigma
