Windows: Process Execution of TTDInject.exe (ttdinject.exe)

title: "Windows: Process Execution of TTDInject.exe (ttdinject.exe)"
id: c581af9e-dc93-4498-801a-5fdde88f9a7e
status: test
description: This rule flags process creation events where the executable name ends with ttdinject.exe or where the OriginalFileName is TTDInject.EXE. TTDInject.exe is used on Windows 10 v1809 and newer for time travel debugging, making its appearance noteworthy for both legitimate debugging and potential abuse. The detection relies on Windows process creation telemetry, specifically the process image name/filename and the OriginalFileName field.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml
author: frack113, Huntrule Team
date: 2022-05-16
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith: ttdinject.exe
    - OriginalFileName: TTDInject.EXE
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: b27077d6-23e6-45d2-81a0-e2b356eea5fd
    type: derived