Title:Use of TTDInject.exe Status:test Description:Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe) References: -https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/ Author: frack113 Date: 2022-05-16 modified:None Tags:
-'attack.execution'
-'attack.stealth'
-'attack.t1127'
Logsource:
product: windows
category: process_creation
Detection: selection: Image|endswith:'ttdinject.exe'OriginalFileName:'TTDInject.EXE'condition:selection Falsepositives:
-Legitimate use Level:medium
