diff --git a/yml/OtherMSBinaries/XBootMgrSleep.yml b/yml/OtherMSBinaries/XBootMgrSleep.yml index 7092de0..672dc8c 100644 --- a/yml/OtherMSBinaries/XBootMgrSleep.yml +++ b/yml/OtherMSBinaries/XBootMgrSleep.yml @@ -4,15 +4,15 @@ Description: Windows Performance Toolkit binary used for tracing and analyzing s Author: Avihay Eldad Created: 2024-06-13 Commands: - - Command: xbootmgrsleep.exe 1000 "{CMD}" - Description: Execute a command with XBootMgrSleep as a parent process, with a 1 second (=1000 milliseconds) delay. - Usecase: Performs execution of specified command, can be used as a defense evasion + - Command: xbootmgrsleep.exe 1000 {PATH:.exe} + Description: Execute executable via XBootMgrSleep, with a 1 second (=1000 milliseconds) delay. Alternatively, it is also possible to replace the delay with any string for immediate execution. + Usecase: Performs execution of specified executable, can be used as a defense evasion Category: Execute Privileges: User MitreID: T1202 OperatingSystem: Windows Tags: - - Execute: CMD + - Execute: EXE Full_Path: - Path: C:\Program Files\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe - Path: C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe @@ -21,3 +21,5 @@ Resources: Acknowledgement: - Person: Avihay Eldad Handle: '@AvihayEldad' + - Person: Yuval Saban + Handle: '@yuvalsaban3'