Loading story…
Elastic Security Labs reverse engineered Microsoft Time Travel Debugging (TTD), a Windows execution-recording framework that logs user-mode instructions and process state to .run trace files for replay in WinDbg. Its analysis mapped the roles of ttdrecord.dll, TTDInject.exe, TTDRecordCPU.dll, undocumented Windows instrumentation callbacks, and the ProcLaunchMon.sys driver in injecting and recording target processes.
Researchers found that TTD can trace processes without activating conventional anti-debugging checks and that its signed CreateDump.exe component can be used to dump process memory. A concealed PplDebuggingToken option can permit access to Protected Process Light targets, including LSASS, but requires a valid Microsoft-signed, device-bound supplemental Code Integrity policy and is therefore not a practical general-purpose PPL bypass. Defenders can monitor or block TTD components and associated trace activity to reduce abuse risk.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs reverse engineered Microsoft Time Travel Debugging components and documented its tracing architecture, hidden PplDebuggingToken option, potential process-dumping implications, and detection and mitigation approaches. The analysis found that PPL access using the token requires a valid Microsoft-signed, device-bound Code Integrity policy, limiting its practicality as a general PPL bypass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed that Microsoft Defender’s Boot-Time Removal driver, **`BTR.sys`**, can be repurposed as a Microsoft-signed kernel primitive for arbitrary file and registry operations, allowing attackers with administrator rights and **`SeLoadDriverPrivilege`** to tamper with protected security components during early startup. The researchers reverse engineered the driver’s undocumented transaction protocol, including its **RC4-encrypted** format and **`:changelist`** alternate data stream, and released the **`BTR_CLI`** proof-of-concept to generate valid transactions and stage the driver across Windows 7 through Windows 11 25H2. The technique does not rely on a memory-corruption flaw or traditional bring-your-own-vulnerable-driver abuse, but instead uses a trusted built-in Windows component that is not covered by Microsoft’s vulnerable driver block rules or common LOLDrivers-style blocking approaches. Researchers said the boot-time execution window could let attackers delete or move files such as **`WdFilter.sys`** and **`MsMpEng.exe`**, or modify service-related registry keys before higher-level protections fully initialize; they reported no observed in-the-wild exploitation and recommended focusing on behavioral detection, monitoring **ADS `:changelist` creation**, unusual **`BTR.sys`** loads, suspicious service staging, **`BootClean.log`** artifacts, and tighter control of **`SeLoadDriverPrivilege`**.
Aug 26, 2026
Cymulate researchers disclosed **Blindside**, a Windows defense-evasion technique that uses hardware breakpoints and debug registers to acquire a clean `ntdll.dll` image and replace the hooked `.text` section in a target process. It creates a child process under debugging, breaks on `LdrLoadDll` to prevent further DLL loading, and copies the child’s clean `ntdll` memory before user-mode EDR instrumentation can be introduced. Cymulate said the technique bypassed many, but not all, tested EDR and XDR products and that it notified affected vendors. The research builds on DLL-unhooking approaches that recover `ntdll` from newly created suspended processes, where the library is mapped before EDR user-mode DLLs may load. Such techniques can locate the module through the PEB, read its clean image from the child process, change target-memory protections, and restore the original `.text` bytes to remove syscall hooks; Cymulate reported a proof of concept subsequently loaded encrypted calculator shellcode against some products. Defenders should detect anomalous debugging activity, especially `SetThreadContext` calls and changes to debug registers `DR0`–`DR3`, correlated with suspended-child creation, `LdrLoadDll` breakpoints, cross-process memory reads, and writes to `ntdll` executable code.
Sep 3, 2026
Microsoft and Elastic published technical details on **Process Ghosting** and related Windows executable image tampering techniques that let malware run after its backing file has been altered or deleted, bypassing antimalware scanning during a time-of-check/time-of-use gap in process creation. The technique abuses legacy process creation behavior, including use of the `NtCreateProcessEx` path, and is closely related to **process doppelganging**, **process herpaderping**, and **process reimaging**. Elastic described how an attacker can create a file, mark it delete-pending, write a payload, map it into an image section, close the handle so the file is removed, and then launch a process from the now fileless image section. Elastic reported that a proof-of-concept showed Windows Defender failing to scan a payload because the file was already delete-pending or deleted when scanning occurred, and said it had reported the issue to Microsoft’s MSRC, which replied that it did not meet the servicing bar. Microsoft later described a detection approach in **Microsoft Defender for Endpoint** that identifies processes created without the `GUID_ECP_CREATE_USER_PROCESS` extra create parameter and checks whether the executable image section lost disk coherency and became page-file-backed via `MmDoesFileHaveUserWritableReferences`. According to Microsoft, combining those signals enables detection of known and previously unpublished variants and can generate alerts for ghosting, herpaderping, and doppelganging seen in the wild.
Aug 15, 2026