Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
MITRE Techniques
18,137
15,664
12,609
8,422
6,243
This rule detects the execution of LiveKD, a Sysinternals tool, specifically when used with the "-m" flag. The "-m" flag is used to force a kernel memory dump, which can be leveraged by attackers for credential dumping or other forms of sensitive information extraction from the kernel memory. This activity is highly suspicious in a production environment and could indicate an attempt at defense evasion or credential access.
