Power configuration changed to stop a host sleeping

Siemphony@siemphonylowT1653unverified

Matches AN1174's observable — powercfg.exe created with arguments that modify sleep, hibernate or display timeouts — but narrowed from "any power setting changed" to "a timeout set to never", because a timeout of zero is what the technique actually needs: the machine stays awake, stays unlocked and keeps running the implant. The eight `<setting>-timeout-<ac|dc> 0` strings cover the standby, hibernate, monitor and disk timeouts on both mains and battery power, and a second selection takes the `-h off` / `-hibernate off` form that removes hibernation outright. Both are written as substrings of the whole command line so the older `powercfg -change -standby-timeout-ac 0` and the documented `powercfg /change standby-timeout-ac 0` spellings both match. Three honest limits: the same change made through `-setacvalueindex` names a power-setting GUID rather than a readable keyword and will not match; a change written straight into the registry under HKLM\SYSTEM\CurrentControlSet\Control\Power creates no process at all; and an unusual amount of whitespace between the setting and its value breaks the literal. AN1175 (Linux systemd-inhibit and /etc/systemd/sleep.conf) and AN1176 (macOS pmset) describe different platforms and different log sources and are not expressed here. The brief maps Security EventID 4688 onto Sigma's `process_creation` category, which is Sysmon-shaped — this rule is written in that vocabulary (`Image`, `CommandLine`), and a raw 4688 feed, whose native field names are `NewProcessName` and `CommandLine`, needs the usual field mapping applied before it can match. 4688 also requires *Audit Process Creation*, and matching on arguments additionally requires the separate *Include command line in process creation events* policy; with either off this rule returns zero rows, and zero rows here means blind, not quiet. UNVERIFIED — derived from MITRE ATT&CK DET0417 and never executed against logs.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\powercfg.exe" and ((ProcessCommandLine contains "standby-timeout-ac 0" or ProcessCommandLine contains "standby-timeout-dc 0" or ProcessCommandLine contains "hibernate-timeout-ac 0" or ProcessCommandLine contains "hibernate-timeout-dc 0" or ProcessCommandLine contains "monitor-timeout-ac 0" or ProcessCommandLine contains "monitor-timeout-dc 0" or ProcessCommandLine contains "disk-timeout-ac 0" or ProcessCommandLine contains "disk-timeout-dc 0") or (ProcessCommandLine contains "-hibernate off" or ProcessCommandLine contains "/hibernate off" or ProcessCommandLine contains "–hibernate off" or ProcessCommandLine contains "—hibernate off" or ProcessCommandLine contains "―hibernate off" or ProcessCommandLine contains "-h off" or ProcessCommandLine contains "/h off" or ProcessCommandLine contains "–h off" or ProcessCommandLine contains "—h off" or ProcessCommandLine contains "―h off")))

Splunk · SPL

Run this as a search.

index=* (Image="*\\powercfg.exe" AND ((CommandLine="*standby-timeout-ac 0*" OR CommandLine="*standby-timeout-dc 0*" OR CommandLine="*hibernate-timeout-ac 0*" OR CommandLine="*hibernate-timeout-dc 0*" OR CommandLine="*monitor-timeout-ac 0*" OR CommandLine="*monitor-timeout-dc 0*" OR CommandLine="*disk-timeout-ac 0*" OR CommandLine="*disk-timeout-dc 0*") OR (CommandLine="*-hibernate off*" OR CommandLine="*/hibernate off*" OR CommandLine="*–hibernate off*" OR CommandLine="*—hibernate off*" OR CommandLine="*―hibernate off*" OR CommandLine="*-h off*" OR CommandLine="*/h off*" OR CommandLine="*–h off*" OR CommandLine="*—h off*" OR CommandLine="*―h off*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\powercfg.exe" AND ((TO_LOWER(process.command_line) LIKE "*standby-timeout-ac 0*" OR TO_LOWER(process.command_line) LIKE "*standby-timeout-dc 0*" OR TO_LOWER(process.command_line) LIKE "*hibernate-timeout-ac 0*" OR TO_LOWER(process.command_line) LIKE "*hibernate-timeout-dc 0*" OR TO_LOWER(process.command_line) LIKE "*monitor-timeout-ac 0*" OR TO_LOWER(process.command_line) LIKE "*monitor-timeout-dc 0*" OR TO_LOWER(process.command_line) LIKE "*disk-timeout-ac 0*" OR TO_LOWER(process.command_line) LIKE "*disk-timeout-dc 0*") OR (TO_LOWER(process.command_line) LIKE "*-hibernate off*" OR TO_LOWER(process.command_line) LIKE "*/hibernate off*" OR TO_LOWER(process.command_line) LIKE "*–hibernate off*" OR TO_LOWER(process.command_line) LIKE "*—hibernate off*" OR TO_LOWER(process.command_line) LIKE "*―hibernate off*" OR TO_LOWER(process.command_line) LIKE "*-h off*" OR TO_LOWER(process.command_line) LIKE "*/h off*" OR TO_LOWER(process.command_line) LIKE "*–h off*" OR TO_LOWER(process.command_line) LIKE "*—h off*" OR TO_LOWER(process.command_line) LIKE "*―h off*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\powercfg\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)((standby-timeout-ac 0|standby-timeout-dc 0|hibernate-timeout-ac 0|hibernate-timeout-dc 0|monitor-timeout-ac 0|monitor-timeout-dc 0|disk-timeout-ac 0|disk-timeout-dc 0)|(-hibernate off|/hibernate off|–hibernate off|—hibernate off|―hibernate off|-h off|/h off|–h off|—h off|―h off))</field>    <description>Power configuration changed to stop a host sleeping</description>    <mitre>      <id>T1653</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: power_settings_tampering
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 3 Sept 2026
Rule ID: 92855449-7353-417e-80b6-2a2a0493eac8

ATT&CKT1653

T1653Power Settings

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonpower settings tampering

power settings tamperingAI draft — unreviewed

01 · What this rule detects

A powercfg.exe process created with arguments that switch a sleep, hibernate, display or disk timeout off — the configuration change that keeps a compromised host awake, unlocked and running the implant instead of dropping into standby. AN1174 asks for "command execution of powercfg.exe with arguments modifying sleep, hibernate, or display timeouts". The rule narrows that: not any power setting changed, but a timeout driven to zero, plus hibernation removed outright. That buys fidelity and costs coverage — see the tuning section.

02 · Telemetry you need

category: process_creation, product: windows, copied from AN1174's single log source, Security EventID 4688.
Two audit prerequisites, neither on by default and neither in the Microsoft or CIS baselines: Audit Process Creation for the event at all, and Include command line in process creation events for the arguments. Every selection here except the binary name reads the command line, so with the second policy off the rule returns zero rows — and zero rows reads as quiet when it means blind.
The brief maps 4688 onto a Sigma category that is Sysmon-shaped, so the rule is written in Image / CommandLine. A raw 4688 feed calls the binary NewProcessName and needs that field mapping applied first. All four backends render this rule.

03 · How the logic works

Three blocks, joined as selection_tool and (selection_timeout_never or selection_hibernate_off). selection_tool is Image|endswith: '\powercfg.exe' — the gate every match must pass. selection_timeout_never is eight CommandLine|contains strings: the standby, hibernate, monitor and disk timeouts, each on mains and battery, each followed by 0. They are matched as substrings of the whole command line rather than as parsed arguments, so powercfg /change standby-timeout-ac 0 and the older powercfg -change -standby-timeout-ac 0 both hit. Those eight strings are the pipeline's own; MITRE named no values anywhere in DET0417. selection_hibernate_off takes -hibernate off and -h off with the windash modifier, which generates the slash spellings as well.

04 · Common false positives

The loudest source is endpoint management enforcing a power baseline — SCCM configuration items, Intune scripts, GPO startup scripts and RMM policies that run powercfg on every host at every policy cycle. In a managed estate that is the dominant match by a wide margin, which is why level is low rather than medium. Next come build and provisioning task sequences: powercfg -h off to reclaim hiberfil.sys on servers and VDI images is routine, and in a virtualised estate that leg is close to pure noise on its own. Last is the administrator who types standby-timeout-ac 0 so an overnight job is not interrupted — the same command line, separated from the technique only by intent.

05 · Detection maturity

tier_1: , the lowest tier, and it stays there until the rule has been run against real data. It is UNVERIFIED: authored from DET0417, never executed against a log line.
tier_2: begins by counting matches per parent process for a fortnight — that alone tells you whether your estate's powercfg traffic is management tooling, and whether low is generous or harsh.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's AllowedAdminTools knob is the right place to start, populated in your environment with the parent process or service account of whichever management agent runs powercfg. Disable the hibernate-off leg first if you need volume back; it carries most of the noise and least of the signal.
Then widen, because the tight form is evadable in one keystroke. standby-timeout-ac 9999 keeps a host awake exactly as well and matches nothing; so does powercfg /setactive with a never-sleep scheme GUID, and so does -setacvalueindex, which names a setting GUID instead of a keyword. MITRE's own cited example — BATLOADER extending lock-screen timeouts — is an increase, not a zero, and is not matched. Dropping 0 from the eight strings covers all of that at a cost the low level already tolerates.
AN1174's other half — correlating the process with the resulting registry change, under its TimeWindow knob — is not expressed here and needs a companion registry_set rule against HKLM\SYSTEM\CurrentControlSet\Control\Power.

Declared by the author

Endpoint management enforcing a power baseline — an SCCM configuration item, an Intune script, a GPO startup script or an RMM policy that runs powercfg with monitor-timeout-ac 0 or standby-timeout-ac 0 on every host at every policy cycle. In a managed estate this is the highest-volume match by a wide margin, and it is why the level is low rather than medium. MITRE's AllowedAdminTools knob is where this gets scoped away, populated with the parent process or account of whichever agent runs it in your environment.
Image build and provisioning task sequences, which routinely run powercfg -h off to reclaim the hiberfil.sys allocation on servers and VDI images and set standby-timeout-ac 0 so a long installation is not interrupted. One match per machine build, but every machine, and in bursts during a rollout.
OEM laptop power utilities, conference-room and kiosk software, and presentation modes that apply a never-sleep profile whenever a device is docked or projecting, then revert it afterwards — producing pairs of matches tied to hardware state rather than to any user action.
A user or administrator typing powercfg /change standby-timeout-ac 0 so an overnight backup, transfer or render is not interrupted, which is the same command line the technique uses and is separated from it only by who ran it and why.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1653, evaluated against their process_creation events.

Share this rule

/u/siemphony/92855449-7353-417e-80b6-2a2a0493eac8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Power configuration changed to stop a host sleeping

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it