Linux systemctl Mask Power Targets to Disable Suspend, Hibernate, Hybrid Sleep
Flags systemctl mask commands targeting suspend/hibernate/hybrid-sleep power management targets.
- Product
- linux
- Category
- process_creation
- Author
- Milad Cheraghi, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2025-10-17
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of systemctl with the mask action and targeting of power management units such as suspend.target, hibernate.target, and hybrid-sleep.target. Masking these targets can prevent the system from entering sleep or related power states, keeping malicious processes running uninterrupted. It relies on Linux process creation telemetry that includes the executable path and command-line arguments showing "systemctl" plus "mask" and the specific *.target units.
Reporting behind it
- man7.orghttps://www.man7.org/linux/man-pages/man1/systemctl.1.html
- linux-audit.comhttps://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_systemctl_mask_power_settings.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux systemctl Mask Power Targets to Disable Suspend, Hibernate, Hybrid Sleep
id: c2f08fcc-44ab-4787-9431-06458a003444
status: experimental
description: This rule identifies process executions of systemctl with the mask action and targeting of power management units such as suspend.target, hibernate.target, and hybrid-sleep.target. Masking these targets can prevent the system from entering sleep or related power states, keeping malicious processes running uninterrupted. It relies on Linux process creation telemetry that includes the executable path and command-line arguments showing "systemctl" plus "mask" and the specific *.target units.
author: Milad Cheraghi, Nasreddine Bencherchali, Huntrule Team
date: 2025-10-17
references:
- https://www.man7.org/linux/man-pages/man1/systemctl.1.html
- https://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_systemctl_mask_power_settings.yml
tags:
- attack.persistence
- attack.impact
- attack.t1653
logsource:
category: process_creation
product: linux
detection:
selection_systemctl:
Image|endswith: /systemctl
CommandLine|contains: " mask"
selection_power_options:
CommandLine|contains:
- suspend.target
- hibernate.target
- hybrid-sleep.target
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: c172b7b5-f3a1-4af2-90b7-822c63df86cb
type: derived