huntrule

Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution

Alerts when tttracer.exe is the parent process of a spawned process on Windows.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Ensar Şamil, @sblmsrsn, @oscd_initiative (SigmaHQ), DRL 1.1
Published
2020-10-06
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion → Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation where the parent executable name ends with '\tttracer.exe', indicating use of the Time Travel Debugging utility. Adversaries may leverage this utility to execute additional malicious processes and perform credential and process dumping actions (for example, targeting lsass.exe). The detection relies on Windows process creation telemetry, specifically the parent image path recorded for child processes.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange
Windows Time Travel Debugging DLL Loads (ttdrecord/ttdwriter/ttdloader)
Malicious Mimikatz Credential Dumping via Command Line Arguments
Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)
Suspicious Physical Memory Acquisition via WinPmem (via process_creation)
Suspicious .NET LOLBin Execution via CasPol or RegAsm
Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation
Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)
Suspicious extrac32 CAB Extraction Abuse
Malicious cdb.exe Masquerading as fontdrvhost in ProgramData (via process_creation)
Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution
Pivot detection · T1003.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.