Time Travel Debugging Utility Usage - Image

Title: Time Travel Debugging Utility Usage - Image
Status: test
Description:Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
  -https://twitter.com/mattifestation/status/1196390321783025666
  -https://twitter.com/oulusoyum/status/1191329746069655553
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative
Date: 2020-10-06
modified:2022-12-02
Tags:

• -'attack.credential-access'
• -'attack.stealth'
• -'attack.t1218'
• -'attack.t1003.001'

Logsource:

• product: windows
• category: image_load

Detection:
  selection:
    ImageLoaded|endswith:
      -'\ttdrecord.dll'
      -'\ttdwriter.dll'
      -'\ttdloader.dll'

  condition:selection
Falsepositives:
  -Legitimate usage by software developers/testers
Level: high