Kernel Memory Dump Via LiveKD
This rule detects the execution of LiveKD, a Sysinternals tool, specifically when used with the "-m" flag. The "-m" flag is used to force a kernel memory dump, which can be leveraged by attackers for credential dumping or other forms of sensitive information extraction from the kernel memory. This activity is highly suspicious in a production environment and could indicate an attempt at defense evasion or credential access.
Sigma
