Windows Time Travel Debugging DLL Loads (ttdrecord/ttdwriter/ttdloader)

Flags Windows image loads of Time Travel Debugging Utility DLLs (tdrecord/tdwriter/tdloader), often abused for stealthy credential dumping.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative (SigmaHQ), DRL 1.1
Published: 2020-10-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion → Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows image load events where tttracer-related Time Travel Debugging DLLs are loaded. Such activity can indicate debugging or data-capture tooling that may be abused to support credential-access and process-dumping attempts, including targeting sensitive processes. Detection relies on telemetry that records loaded image paths for Windows processes and matches specific DLL filenames: ttdrecord.dll, ttdwriter.dll, and ttdloader.dll.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution

Malicious PowerDump Credential Extraction via PowerShell

Malicious LSASS Credential Dump via rundll32 comsvcs.dll (via process_creation)

Malicious LSASS Memory Dump via rundll32 comsvcs MiniDump in tasklist For-Loop (via process_creation)

Malicious Mimikatz Credential Dumping via Command Line Arguments

Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)

Suspicious Physical Memory Acquisition via WinPmem (via process_creation)

Suspicious .NET LOLBin Execution via CasPol or RegAsm

Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation

Windows Time Travel Debugging DLL Loads (ttdrecord/ttdwriter/ttdloader)

Pivot detection · T1003.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-image-load-of-tttracer-dlls-for-time-travel-debugging-utility-e76c8240

title: Windows Time Travel Debugging DLL Loads (ttdrecord/ttdwriter/ttdloader)
id: eb6c6cdb-ca98-49be-afe9-983d5493b141
status: test
description: "This rule identifies Windows image load events where tttracer-related Time Travel Debugging DLLs are loaded. Such activity can indicate debugging or data-capture tooling that may be abused to support credential-access and process-dumping attempts, including targeting sensitive processes. Detection relies on telemetry that records loaded image paths for Windows processes and matches specific DLL filenames: ttdrecord.dll, ttdwriter.dll, and ttdloader.dll."
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
  - https://twitter.com/mattifestation/status/1196390321783025666
  - https://twitter.com/oulusoyum/status/1191329746069655553
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_tttracer_module_load.yml
author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Huntrule Team
date: 2020-10-06
modified: 2022-12-02
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1218
  - attack.t1003.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith:
      - \ttdrecord.dll
      - \ttdwriter.dll
      - \ttdloader.dll
  condition: selection
falsepositives:
  - Legitimate usage by software developers/testers
level: high
license: DRL-1.1
related:
  - id: e76c8240-d68f-4773-8880-5c6f63595aaf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL