Use of TTDInject.exe (b27077d6-23e6-45d2-81a0-e2b356eea5fd)
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Use of TTDInject.exe (b27077d6-23e6-45d2-81a0-e2b356eea5fd) | Sigma-Rules | Trusted Developer Utilities Proxy Execution - T1127 (ff25900d-76d5-449b-a351-8824e62fc81b) | Attack Pattern | 1 |