Time Travel Debugging Utility Usage

Title: Time Travel Debugging Utility Usage
Status: test
Description:Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
  -https://twitter.com/mattifestation/status/1196390321783025666
  -https://twitter.com/oulusoyum/status/1191329746069655553
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative
Date: 2020-10-06
modified:2022-10-09
Tags:

• -'attack.credential-access'
• -'attack.stealth'
• -'attack.t1218'
• -'attack.t1003.001'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    ParentImage|endswith: '\tttracer.exe'
  condition:selection
Falsepositives:
  -Legitimate usage by software developers/testers
Level: high