Techniques › T1653
T1653 Power Settings
persistence — Windows, Linux, macOS, Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
1
Sigma rules tagged attack.t1653
1
KEV CVEs mapped here
<p>Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.</p><p>Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.</p><p>For example,
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down. Adversaries may also extend system lock screen timeout settings. Other relevant settings, such as disk and hibernate timeout, can be similarly abused to keep the infected machine running even if no user is active.</p><p>Aware that some malware cannot survive system reboots, adversaries may entirely delete files used to invoke system shut down or reboot.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-20353 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | primary impact | Mapped | 2024-04-24 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0417 Detection Strategy for Power Settings Abuse v1.0
AN1174 WindowsMonitor command execution of powercfg.exe with arguments modifying sleep, hibernate, or display timeouts. Abnormal or repeated modifications to power settings outside administrative baselines may indicate persistence attempts. Correlate process creation with registry and system configuration changes to build behavioral chains.Tunable:
AllowedAdminToolsTimeWindowAN1175 LinuxDetect execution of system utilities (systemctl, systemd-inhibit, systemdsleep) modifying sleep or hibernate behavior. Abnormal edits to system configuration files (e.g., /etc/systemd/sleep.conf) should be correlated with process execution to identify persistence techniques.auditd:SYSCALLexecve: Execution of systemctl, loginctl, or systemd-inhibit commands related to sleep/hibernate→ DC0064 Command Executionauditd:PATHwrite: File modifications to /etc/systemd/sleep.conf or related power configuration files→ DC0061 File ModificationTunable:KnownMaintenanceWindowsAN1176 macOSMonitor pmset command executions altering sleep/hibernate/standby parameters. Unexpected modifications to /Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist or similar files should be correlated with process activity.macos:unifiedlogProcess creation events where command line = pmset with arguments affecting sleep, hibernatemode, displaysleep→ DC0032 Process Creationmacos:unifiedlogwrite: File modification to com.apple.PowerManagement.plist or related system preference files→ DC0061 File ModificationTunable:AdminWhitelists
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1653
Author: Milad Cheraghi, Nasreddine Bencherchali
· 2025-10-17 · logsource: product=linux category=process_creation · c172b7b5-f3a1-4af2-90b7-822c63df86cb
Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.