Rule Info
Tags
attack.defense_evasion DEMO
Name
Kernel Memory Dump Via LiveKD
Id
c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2
Date
2023-05-16 00:00:00
Modified
None
Description
Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory
Author
Nasreddine Bencherchali (Nextron Systems)
Type
Community Rule
Link to Public Repo
Rule History
Title
Author
Commit
Date
Scan your endpoints, forensic images or collected files with our portable scanner THOR