Suspicious Powercfg Execution To Change Lock Screen Timeout

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Suspicious Powercfg Execution To Change Lock Screen Timeout
id: f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b
status: test
description: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout
references:
    - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
    - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options
author: frack113
date: 2022-11-18
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_power:
        - Image|endswith: '\powercfg.exe'
        - OriginalFileName: 'PowerCfg.exe'
    selection_standby:
        # powercfg.exe /SETACVALUEINDEX SCHEME_CURRENT SUB_VIDEO VIDEOCONLOCK
        - CommandLine|contains|all:
              - '/setacvalueindex '
              - 'SCHEME_CURRENT'
              - 'SUB_VIDEO'
              - 'VIDEOCONLOCK'
        # powercfg -change -standby-timeout-dc 3000
        # powercfg -change -standby-timeout-ac 3000
        - CommandLine|contains|all:
              - '-change '
              - '-standby-timeout-'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_power`

selection_power:
    - Image|endswith: '\powercfg.exe'
    - OriginalFileName: 'PowerCfg.exe'

Stage 2: `selection_standby`

selection_standby:
    - CommandLine|contains|all:
          - '/setacvalueindex '
          - 'SCHEME_CURRENT'
          - 'SUB_VIDEO'
          - 'VIDEOCONLOCK'
    - CommandLine|contains|all:
          - '-change '
          - '-standby-timeout-'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-change` `-standby-timeout-` `/setacvalueindex` `SCHEME_CURRENT` `SUB_VIDEO` `VIDEOCONLOCK`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\powercfg.exe`	`field:"Image" kind:ends_with value:"\powercfg.exe"`
`OriginalFileName`	eq	`PowerCfg.exe`	`field:"OriginalFileName" kind:eq value:"PowerCfg.exe"`

Suspicious Powercfg Execution To Change Lock Screen Timeout

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_power

Stage 2: selection_standby

Indicators

Stage 0: `condition`

Stage 1: `selection_power`

Stage 2: `selection_standby`