Detectionmediumexperimental
Uncommon Child Process Spawned From XBootMgrSleep.EXE
Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe. XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection:
ParentImage|endswith: '\xbootmgrsleep.exe'
filter_main_xbootmgr:
Image: 'C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe'
condition: selection and not 1 of filter_main_*False Positives
Custom Windows Performance Toolkit automation that intentionally launches another executable through XBootMgrSleep.exe
MITRE ATT&CK
Tactics
Techniques
Rule Metadata
Rule ID
74697c29-1b30-4e1f-a517-33574061821d
Status
experimental
Level
medium
Type
Detection
Created
Sun Sep 27
Author
Path
rules/windows/process_creation/proc_creation_win_xbootmgrsleep_uncommon_child_process.yml
Raw Tags
attack.stealthattack.t1202