Sigma rule: Uncommon Child Process Spawned From XBootMgrSleep.EXE

Rule

Title

Uncommon Child Process Spawned From XBootMgrSleep.EXE

Status

experimental

Level

medium

Author

Diablo Research

Date

2026-09-27

File

rules/windows/process_creation/proc_creation_win_xbootmgrsleep_uncommon_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe.
XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith: '\xbootmgrsleep.exe'
filter_main_xbootmgr:
    Image: 'C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Custom Windows Performance Toolkit automation that intentionally launches another executable through XBootMgrSleep.exe

Tags

• attack.stealth
• attack.t1202

MITRE ATT&CK ids this rule names

• T1202

References

• https://lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgrSleep/
• https://learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_xbootmgrsleep_uncommon_child_process.yml