MITRE ATT&CK technique

Power Settings detection rulesT1653

Power Settings (T1653) is a MITRE ATT&CK technique in the Persistence tactic. This page lists the 1 community-maintained Sigma detection rule in the library mapped to T1653 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target linux.

T1653 on attack.mitre.org1 rule

Tactic

Persistence

Mask System Power Settings Via Systemctl
high
Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
linux · process_creation

Top products

Tactic

Mask System Power Settings Via Systemctl