Time Travel Debugging Utility Usage
Detects the usage of the Time Travel Debugging (TTD) utility (tttracer.exe). Adversaries can leverage tttracer.exe to execute malicious processes or dump process memory, such as LSASS, for credential access. This rule specifically looks for process creation events where tttracer.exe is the parent process, indicating its use to launch other processes.
Sigma
