Windows: Process creation of TTDInject.exe (ttdinject.exe) for Time Travel Debugging

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule detects execution of TTDInject.exe by matching process creation where the image ends with ttdinject.exe and the OriginalFileName is TTDInject.EXE. Attackers can use this binary to support stealthy debugging and analysis workflows associated with Windows Time Travel Debugging. The detection relies on Windows process creation telemetry, specifically the spawned process image path and original file metadata.

Reporting behind it

Related detections9 linkedT1127 — drag to rearrange

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Suspicious Child Process of aspnet_compiler.exe on Windows

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Windows: Detect kavremover-related LOLBIN command-line usage

Windows node.exe Execution with -e/--eval and suspicious child process usage

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Windows Process Creation: Mftrace.exe Child Process Execution

Windows Process Creation: Remote.exe Execution

Windows: Process creation of TTDInject.exe (ttdinject.exe) for Time Travel Debugging

Pivot detection · T1127 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-ttdinject-exe-ttdinject-exe-b27077d6

title: "Windows: Process creation of TTDInject.exe (ttdinject.exe) for Time Travel Debugging"
id: c581af9e-dc93-4498-801a-5fdde88f9a7e
status: test
description: This rule detects execution of TTDInject.exe by matching process creation where the image ends with ttdinject.exe and the OriginalFileName is TTDInject.EXE. Attackers can use this binary to support stealthy debugging and analysis workflows associated with Windows Time Travel Debugging. The detection relies on Windows process creation telemetry, specifically the spawned process image path and original file metadata.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml
author: frack113, Huntrule Team
date: 2022-05-16
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith: ttdinject.exe
    - OriginalFileName: TTDInject.EXE
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: b27077d6-23e6-45d2-81a0-e2b356eea5fd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL