Rule Info
Name
Uncommon Child Process Spawned From XBootMgrSleep.EXE
Author
Diablo Research
Description
Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe.
XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.
Date
2026-09-27 00:00:00
Modified
None
Id
74697c29-1b30-4e1f-a517-33574061821d
Tags
attack.stealth attack.t1202
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Diablo-research
Merge PR #6336 from @Diablo-research - Add `Uncommon Child Process Spawned From XBootMgrSleep.EXE`
2026-10-02
Scan your endpoints, forensic images or collected files with our portable scanner THOR