Windows: Image Load of tttracer DLLs for Time Travel Debugging Utility

Flags Windows image loads of Time Travel Debugging Utility DLLs (tdrecord/tdwriter/tdloader), often abused for stealthy credential dumping.

FreeUnreviewedSigmahighv1

windows-image-load-of-tttracer-dlls-for-time-travel-debugging-utility-e76c8240

title: "Windows: Image Load of tttracer DLLs for Time Travel Debugging Utility"
id: eb6c6cdb-ca98-49be-afe9-983d5493b141
status: test
description: This rule identifies when the Windows loader loads Time Travel Debugging Utility components by matching image paths that end with tdrecord.dll, tdwriter.dll, or tdloader.dll. Attackers may use this utility to launch processes and enable stealthy credential-related activity such as dumping process memory (e.g., lsass.exe). The detection relies on image load telemetry that records the fully qualified path or image name loaded into the system.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
  - https://twitter.com/mattifestation/status/1196390321783025666
  - https://twitter.com/oulusoyum/status/1191329746069655553
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_tttracer_module_load.yml
author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Huntrule Team
date: 2020-10-06
modified: 2022-12-02
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1218
  - attack.t1003.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith:
      - \ttdrecord.dll
      - \ttdwriter.dll
      - \ttdloader.dll
  condition: selection
falsepositives:
  - Legitimate usage by software developers/testers
level: high
license: DRL-1.1
related:
  - id: e76c8240-d68f-4773-8880-5c6f63595aaf
    type: derived

What it detects

This rule identifies when the Windows loader loads Time Travel Debugging Utility components by matching image paths that end with tdrecord.dll, tdwriter.dll, or tdloader.dll. Attackers may use this utility to launch processes and enable stealthy credential-related activity such as dumping process memory (e.g., lsass.exe). The detection relies on image load telemetry that records the fully qualified path or image name loaded into the system.

Known false positives

Legitimate usage by software developers/testers

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.