public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 12:42:19 +02:00
Code Issues Projects Releases Wiki Activity

Generalising file paths and urls, see #10 (#422)

Browse Source
This commit is contained in:
Wietze
2025-01-28 11:15:01 +00:00
committed by GitHub
parent e62749f81a
commit a79893e7ad
196 changed files with 555 additions and 758 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
yml/OSBinaries/Tttracer.yml
View File

@@ -1,11 +1,11 @@
---
Name: Tttracer.exe
Description: Used by Windows 1809 and newer to Debug Time Travel
Author: 'Oddvar Moe'
Author: Oddvar Moe
Created: 2019-11-05
Commands:
- Command: tttracer.exe C:\windows\system32\calc.exe
Description: Execute calc using tttracer.exe. Requires administrator privileges
- Command: tttracer.exe {PATH_ABSOLUTE:.exe}
Description: Execute specified executable from tttracer.exe. Requires administrator privileges.
Usecase: Spawn process using other binary
Category: Execute
Privileges: Administrator
@@ -13,7 +13,7 @@ Commands:
OperatingSystem: Windows 10 1809 and newer, Windows 11
Tags:
- Execute: EXE
- Command: TTTracer.exe -dumpFull -attach pid
- Command: TTTracer.exe -dumpFull -attach {PID}
Description: Dumps process using tttracer.exe. Requires administrator privileges
Usecase: Dump process by PID
Category: Dump
@@ -23,8 +23,6 @@ Commands:
Full_Path:
- Path: C:\Windows\System32\tttracer.exe
- Path: C:\Windows\SysWOW64\tttracer.exe
Code_Sample:
- Code:
Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml
- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_tttracer_mod_load.yml