Query: write Sigma for Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory
Matching passage: Sigma rule: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory. Logsource: windows / process_creation. Rule: title: Kernel Memory Dump Via LiveKD id: c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2 status: test description: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory references: - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd - https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/ - https://kb.acronis.com/content/60892 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2024-03-13 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \livekd.exe - \livekd64.exe - OriginalFileName: livekd.exe selection_cli: CommandLine|contains|windash: ' -m' condition: all of selection_* falsepositives: - Unlikely in production environment level: high
Near-miss passage: Sigma rule: Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a. Logsource: linux / process_creation. Rule: title: Syslog Clearing or Removal Via System Utilities id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31 status: test description: 'Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2025-10-15 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux category: process_creation detection: selection_file: CommandLine|contains: /var/log/syslog selection_command_rm: Image|endswith: /rm CommandLine|contains: - ' -r ' - ' -f ' - ' -rf ' - /var/log/syslog selection_command_unlink: Image|endswith: /unlink selection_command_mv: Image|endswith: /mv selection_command_truncate: Image|endswith: /truncate CommandLine|contains|all: - '0 ' - /var/log/syslog CommandLine|contains: - '-s ' - '-c ' - --size selection_command_ln: Image|endswith: /ln CommandLine|contains|all: - '/dev/null ' - /var/log/syslog CommandLine|contains: - '-sf ' - '-sfn ' - '-sfT ' selection_command_cp: Image|endswith: /cp CommandLine|contains: /dev/null selection_command_shred: Image|endswith: /shred CommandLine|contains: '-u ' selection_unique_other: CommandLine|contains: - ' > /var/log/syslog' - ' >/var/log/syslog' - ' >| /var/log/syslog' - ': > /var/log/syslog' - :> /var/log/syslog - :>/var/log/syslog - '>|/var/log/syslog' selection_unique_journalctl: CommandLine|contains: - journalctl --vacuum - journalctl --rotate condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_* falsepositives: - Log rotation. - Maintenance. level: high