Suspicious Powercfg Execution To Change Lock Screen Timeout (via process_creation)

title: Suspicious Powercfg Execution To Change Lock Screen Timeout (via process_creation)
id: 9ed84e13-ee4d-552c-b35c-788df57509f3
status: stable
description: This rule detects anomalous execution of 'Powercfg.exe' to change lock screen timeout
references:
    - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
    - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options
author: Huntrule Team
date: 2026-05-25
tags:
    - attack.stealth
    - attack.persistence
    - attack.t1653
logsource:
    category: process_creation
    product: windows
detection:
    selection_power:
        - Image|endswith: '\powercfg.exe'
        - OriginalFileName: 'PowerCfg.exe'
    selection_standby:
        - CommandLine|contains|all:
              - '/setacvalueindex '
              - 'SCHEME_CURRENT'
              - 'SUB_VIDEO'
              - 'VIDEOCONLOCK'
        - CommandLine|contains|all:
              - '-change '
              - '-standby-timeout-'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium