Linux: systemctl mask used to disable power management targets

title: "Linux: systemctl mask used to disable power management targets"
id: c2f08fcc-44ab-4787-9431-06458a003444
status: experimental
description: This rule identifies Linux process executions of systemctl with the mask operation that target power management states. Masking suspend, hibernate, or hybrid-sleep targets can keep the system from entering sleep or shutdown modes, supporting adversary goals such as maintaining uninterrupted execution. It relies on process creation telemetry capturing the systemctl command line and the specified systemd target strings.
author: Milad Cheraghi, Nasreddine Bencherchali, Huntrule Team
date: 2025-10-17
references:
  - https://www.man7.org/linux/man-pages/man1/systemctl.1.html
  - https://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_systemctl_mask_power_settings.yml
tags:
  - attack.persistence
  - attack.impact
  - attack.t1653
logsource:
  category: process_creation
  product: linux
detection:
  selection_systemctl:
    Image|endswith: /systemctl
    CommandLine|contains: " mask"
  selection_power_options:
    CommandLine|contains:
      - suspend.target
      - hibernate.target
      - hybrid-sleep.target
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c172b7b5-f3a1-4af2-90b7-822c63df86cb
    type: derived