Uncommon Child Process Spawned From XBootMgrSleep.EXE

MediumSplunk security content

Child Processes of Spoolsv exe

The following analytic identifies child processes spawned by spoolsv.exe, the Print Spooler service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as those associated with CVE-2018-8440, which can lead to privilege escalation.

T1068

Written by: Rico ValdezAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 3, 2026

HighElastic detection rules

Base64 Decoded Payload Piped to Interpreter

This rule detects when a base64 decoded payload is piped to an interpreter on Linux systems. Adversaries may use base64 encoding to obfuscate data and pipe it to an interpreter to execute malicious code. This technique may be used to evade detection by host- or network-based security controls.

T1027T1059T1059.004T1059.006T1059.011+3 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 3, 2026

MediumSigmaHQ

Potential WSL InstallLocation Registry Key Modification

Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key. Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.

T1112T1218

Written by: Liran RavichAttributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

MediumSigmaHQ

Uncommon Child Process Spawned From XBootMgrSleep.EXE

Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe. XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.

T1202

Written by: Diablo ResearchAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

HighSigmaHQ

Suspicious WSL Binary Masquerading

Detects execution of masqueraded wsl.exe binary. Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary, bypassing detection based on image name alone and abusing user trust in the WSL process name.

T1036.005T1218

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

HighSigmaHQ

Suspicious WSL InstallLocation Registry Key Modification Via CommandLine

Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments. Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update. Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.

T1112T1218

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

HighSigmaHQ

Suspicious WSL Binary Hijack via Proxy Execution

Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there. An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload, which then appears as a wsl.exe child of the legitimate System32 stub.

T1036.005T1218

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

HighSigmaHQ

Renamed Schtasks Execution

Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. One of the very common persistence techniques is schedule malicious tasks using schtasks.exe. Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.

T1036.003T1053.005

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

HighSigmaHQ

Suspicious Kerberos Ticket Request via CLI

Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks. Encoded commands will not surface the class name, so the ps_script rule covers that instead.

T1558.003

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

HighSigmaHQ

Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock

Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberoasting or silver ticket attack. A TGS request is issued by the KerberosRequestorSecurityToken constructor, resulting tickets are cached in LSA and become extractable by other tools later on.

T1558.003

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

MediumSigmaHQ

Potential WSL Binary Modification from Installed Location

Detects the modification of the wsl.exe binary from its installed location. Attackers can replace the legitimate wsl.exe binary with a malicious payload in its place, which is then executed when the user runs WSL, acting as a proxy execution and defense evasion technique.

T1036.005T1218

Written by: Liran RavichAttributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

HighSigmaHQ

Bitsadmin to Uncommon TLD

Detects Bitsadmin connections to domains with uncommon TLDs

T1071.001T1197

Written by: Florian Roth (Nextron Systems)Attributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

HighSigmaHQ

Azure Subscription Permission Elevation Via AuditLogs

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

T1078

Written by: Austin Songer @austinsongerAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 3, 2026

InformationalSplunk security content

Windows Defender Intermediary Artifact Was Observed

The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks. Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the symbolic link to redirect the remediation process to a staging directory controlled by the attacker.

T1068

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 2, 2026

InformationalSplunk security content

Windows Alternate Data Stream Created Over Local Share

The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. Legitimate local processes access files directly rather than through a local SMB share.

T1021.002T1564.004

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 2, 2026

MediumSplunk security content

Windows Admin Password Changed by Non-Admin

The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.

T1068T1543.003

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 2, 2026

MediumSplunk security content

Windows AD User Suspicious UPN Change

The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738. This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account.

T1078.002

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 2, 2026

HighMicrosoft Sentinel analytics

SAP BTP - Critical vulnerability finding in custom app

Identifies SAP BTP Application Vulnerability Report Service findings where the CVSS score exceeds a configurable threshold (default 9.0, i.e. Critical severity). Such findings indicate custom applications deployed on SAP BTP that carry vulnerable open-source packages or components with a known, high-impact CVE. These risky applications should be prioritized for remediation and reviewed for signs of exploitation.

T1190

Licence: MIT License
Published: Oct 2, 2026

MediumElastic detection rules

Lure-Themed Internet-Delivered RMM Executable

Identifies an Internet-delivered remote monitoring and management (RMM) executable whose filename disguises it as a document, invitation, or another company's application. Attackers may use that lure, often through social engineering, to gain remote access to the endpoint.

T1036T1204T1204.002T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

Potential RMM Execution from a Commonly Abused Web Service

Identifies execution of software whose reported code-signature subject matches a known remote monitoring and management (RMM) publisher with a download origin on a commonly abused web service. Adversaries use these services to deliver remote-access software during social engineering and intrusion campaigns.

T1105T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Created a LaunchAgent or LaunchDaemon

Detects the first time a Python process creates or modifies a LaunchAgent or LaunchDaemon plist file on a given host. Malicious Python scripts, compromised dependencies, or model file deserialization can establish persistence on macOS by writing plist files to LaunchAgent or LaunchDaemon directories. Legitimate Python processes do not typically create persistence mechanisms, so a first occurrence is a strong indicator of compromise.

T1543T1543.001T1543.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Spawned a Shell on Host

Detects the first time a Python process spawns a shell on a given host. Malicious Python scripts, compromised dependencies, or model file deserialization can result in shell spawns that would not occur during normal workflows. Since legitimate Python processes rarely shell out to interactive shells, a first occurrence of this behavior on a host is a strong signal of potential compromise.

T1059T1059.004T1059.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Accessed Sensitive Credential Files

Detects the first time a Python process accesses sensitive credential files on a given host. This behavior may indicate post-exploitation credential theft via a malicious Python script, compromised dependency, or malicious model file deserialization. Legitimate Python processes do not typically access credential files such as SSH keys, AWS credentials, browser cookies, Kerberos tickets, or keychain databases, so a first occurrence is a strong indicator of compromise.

T1539T1552T1552.001T1555T1555.001+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

CriticalElastic detection rules

Zimbra Swatchdog SNMP Command Injection Execution

Detects a Unix shell launched by Perl from a generated Zimbra ".swatchdog_script" when the shell command line contains an "snmptrap" invocation and Zimbra SNMP service fields, followed by an unexpected child process other than "snmptrap". This sequence provides high-confidence evidence of external command execution through CVE-2026-73570, an unauthenticated command-injection vulnerability in Zimbra's SNMP monitoring path.

T1059T1059.004T1190

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Root Password Changed

Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API. Replacing it locks out the previous password and gives the new value full control of the host. Hostd records `Password was changed for account root`. The shell records `esxcli system account set -i root`.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Account Granted Admin Role

Detects an ESXi account being granted the Administrator role. Administrator is full control of the host, including the firewall, SSH, accounts, and every virtual machine. Granting it to another account keeps that access after the original session ends.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Local Account Created

Detects creation of a local ESXi account. A new account is a separate login that remains after the session that created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host.

T1136T1136.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi SSH Session from vpxuser

Identifies a successful SSH session opened by the privileged vpxuser account. vpxuser is a service account used by VMware vCenter Server to manage ESXi hosts. An SSH session from that account reaches the host shell directly, outside the vCenter management path, and is a sign the credential is being reused with malicious intent.

T1021T1021.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi SSH Access Enabled

Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands against the datastore.

T1021T1021.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Root Password Accepted from Remote Host

Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.

T1078T1078.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

Reference	Class	Cited by
learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference	Product documentation	Only this detection cites it
lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgrSleep/	Tool	Only this detection cites it

Detection rules

Uncommon Child Process Spawned From XBootMgrSleep.EXE

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules