Sigma Rules

Uncommon Child Process Spawned From XBootMgrSleep.EXE

Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe. XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.