Detection rules › Sigma
Use of TTDInject.exe
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Known false positives
- Legitimate use
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: Use of TTDInject.exe
id: b27077d6-23e6-45d2-81a0-e2b356eea5fd
status: test
description: Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/
author: frack113
date: 2022-05-16
tags:
- attack.execution
- attack.stealth
- attack.t1127
logsource:
product: windows
category: process_creation
detection:
selection:
- Image|endswith: 'ttdinject.exe'
- OriginalFileName: 'TTDInject.EXE'
condition: selection
falsepositives:
- Legitimate use
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
- Image|endswith: 'ttdinject.exe'
- OriginalFileName: 'TTDInject.EXE'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with value:"ttdinject.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"TTDInject.EXE" |