Uncommon Child Process Spawned From XBootMgrSleep.EXE

Title: Uncommon Child Process Spawned From XBootMgrSleep.EXE
Status: experimental
Description:Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe. XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.
References:
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgrSleep/
  -https://learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference
Author: Diablo Research
Date: 2026-09-27
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\xbootmgrsleep.exe'
  filter_main_xbootmgr:
    Image: 'C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Custom Windows Performance Toolkit automation that intentionally launches another executable through XBootMgrSleep.exe
Level: medium