LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

XBootMgr.exe

View source

Windows Performance Toolkit binary used to start performance traces.

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1202

Executes an executable after the trace is complete using the callBack parameter.

COMMAND
xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -callBack {PATH:.exe}
USE CASE
Executes code as part of post-trace automation flow.
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows
Execute · EXE
EXAMPLE 02T1202

Executes an executable before each trace run using the preTraceCmd parameter.

COMMAND
xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -preTraceCmd {PATH:.exe}
USE CASE
Executes code as part of pre-trace automation or staging.
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows
Execute · EXE
02 / ON DISK

Known paths

C:\Program Files\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

No detection resources documented yet.

Contribute detection coverage
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Avihay Eldad@AvihayEldad
Tommy Warren