Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution

Alerts when tttracer.exe is the parent process of a spawned process on Windows.

FreeUnreviewedSigmahighv1

windows-time-travel-debugging-utility-tttracer-exe-process-execution-0b4ae027

title: "Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution"
id: 19edd581-ca02-4460-8d00-d3e49e7f13d0
related:
  - id: e76c8240-d68f-4773-8880-5c6f63595aaf
    type: derived
  - id: 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a
    type: derived
status: test
description: This rule flags process creation where the parent image ends with tttracer.exe, indicating use of the Time Travel Debugging utility. Attackers can leverage this functionality to execute additional processes and potentially dump sensitive process contents, which is why parent-image telemetry is critical for attribution. It relies on Windows process creation events capturing ParentImage and the executable path.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
  - https://twitter.com/mattifestation/status/1196390321783025666
  - https://twitter.com/oulusoyum/status/1191329746069655553
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml
author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Huntrule Team
date: 2020-10-06
modified: 2022-10-09
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1218
  - attack.t1003.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \tttracer.exe
  condition: selection
falsepositives:
  - Legitimate usage by software developers/testers
level: high
license: DRL-1.1

What it detects

This rule flags process creation where the parent image ends with tttracer.exe, indicating use of the Time Travel Debugging utility. Attackers can leverage this functionality to execute additional processes and potentially dump sensitive process contents, which is why parent-image telemetry is critical for attribution. It relies on Windows process creation events capturing ParentImage and the executable path.

Known false positives

Legitimate usage by software developers/testers

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.