LoFP / custom windows performance toolkit automation that intentionally launches another executable through xbootmgrsleep.exe

Techniques

• t1202

Sample rules

Uncommon Child Process Spawned From XBootMgrSleep.EXE

• source: sigma
• technicques:
  • t1202

Description

Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe. XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_xbootmgr:
  Image: C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe
selection:
  ParentImage|endswith: \xbootmgrsleep.exe