Windows: Suspicious Powercfg Execution Changing Lock/Video Standby Timeout
Detects powercfg.exe commands attempting to change standby/lock-related timeouts on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-11-18
- Updated
- 2026-07-30
What it detects
This rule flags process executions of powercfg.exe where the command line includes parameters indicating changes to the current standby/lock-related timeout settings. Attackers may use power configuration changes to affect system lock behavior or user session persistence without installing additional software. It relies on Windows process creation telemetry, matching on the executable name and required command-line substrings.
Reporting behind it
- blogs.vmware.comhttps://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powercfg_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-powercfg-execution-changing-lock-video-standby-timeout-f8d6a15e
title: "Windows: Suspicious Powercfg Execution Changing Lock/Video Standby Timeout"
id: f7751a61-51b6-471a-bebf-245b648fe100
status: test
description: This rule flags process executions of powercfg.exe where the command line includes parameters indicating changes to the current standby/lock-related timeout settings. Attackers may use power configuration changes to affect system lock behavior or user session persistence without installing additional software. It relies on Windows process creation telemetry, matching on the executable name and required command-line substrings.
references:
- https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
- https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powercfg_execution.yml
author: frack113, Huntrule Team
date: 2022-11-18
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_power:
- Image|endswith: \powercfg.exe
- OriginalFileName: PowerCfg.exe
selection_standby:
- CommandLine|contains|all:
- "/setacvalueindex "
- SCHEME_CURRENT
- SUB_VIDEO
- VIDEOCONLOCK
- CommandLine|contains|all:
- "-change "
- -standby-timeout-
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b
type: derived