Used by Windows 1809 and newer to Debug Time Travel Located at: C:\Windows\System32\tttracer.exe; C:\Windows\SysWOW64\tttracer.exe.
tttracertttracerSandbox: execFile · Timeout: 30s
security.execution.command credential.dump Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Execute specified executable from tttracer.exe. Requires administrator privileges. (Spawn process using other binary)
tttracer.exe {PATH_ABSOLUTE:.exe}Dumps process using tttracer.exe. Requires administrator privileges (Dump process by PID)
TTTracer.exe -dumpFull -attach {PID}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_tttracer_mod_load.yml |
| elastic | https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml |
| ioc | Parent child relationship. Tttracer parent for executed command |
tttracer is a Windows LOLBin. Used by Windows 1809 and newer to Debug Time Travel Located at: C:\Windows\System32\tttracer.exe; C:\Windows\SysWOW64\tttracer.exe.