Time Travel Debugging Utility usage for process dumping
The Time Travel Debugging (TTD) utility is leveraged by threat actors to perform unauthorized process memory dumping, such as lsass.exe, for credential access.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 02:46 UTC
- Detection
- 1 rule
- Source quality
- A1Likely
The Time Travel Debugging (TTD) utility (tttracer.exe), a component of the WinDbg toolkit, can be abused by adversaries for credential access. By attaching to sensitive processes like lsass.exe, the utility can record process execution and generate memory dumps, facilitating credential extraction. This technique is documented as a Living off the Land (LotL) method.
Impact
Successful abuse of TTD allows an attacker to dump the memory of restricted processes, including the Local Security Authority Subsystem Service (LSASS), to extract plaintext passwords, NTLM hashes, or Kerberos tickets from memory.
Recommendation
- Deploy the provided image load detection rules to identify unauthorized TTD module loading.
- Implement process-level monitoring for tttracer.exe execution, as its presence on non-developer endpoints is highly anomalous.
- Apply Application Control policies to restrict the execution of debugging utilities to authorized administrator or developer accounts only.
Immediate actions
Deploy Sigma rules for TTD module loading
Threat Hunt
Search for execution of tttracer.exe in process creation logs
Data: Process Command Line, Parent Process Name
Detection coverage 1
Detect TTD module loading
highDetects the loading of TTD-related modules, which indicates the initialization of the Time Travel Debugging utility.
Detection queries are available on the platform. Get full rules →