Power Settings `T1653`

Tactic: Persistence

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (2 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	1	`contains` 1	`mask`, `hibernate.target`, `hybrid-sleep.target`
`Image`	1	`ends_with` 1	`/systemctl`

Top indicator values (5 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`CommandLine`	`contains`	`mask` sigmaMask System Power Settings Via Systemctl	1
`CommandLine`	`contains`	`hibernate.target` sigmaMask System Power Settings Via Systemctl	1
`CommandLine`	`contains`	`hybrid-sleep.target` sigmaMask System Power Settings Via Systemctl	1
`CommandLine`	`contains`	`suspend.target` sigmaMask System Power Settings Via Systemctl	1
`Image`	`ends_with`	`/systemctl` sigmaMask System Power Settings Via Systemctl	1	4

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Linux

Domain: Endpoint

Sigma 1 rule

Mask System Power Settings Via Systemctl