Uncommon Child Process Spawned From XBootMgrSleep.EXE
Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe. XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.
Sigma
