Windows: Suspicious Powercfg Execution Changing Lock/Video Standby Timeout

title: "Windows: Suspicious Powercfg Execution Changing Lock/Video Standby Timeout"
id: f7751a61-51b6-471a-bebf-245b648fe100
status: test
description: This rule flags process executions of powercfg.exe where the command line includes parameters indicating changes to the current standby/lock-related timeout settings. Attackers may use power configuration changes to affect system lock behavior or user session persistence without installing additional software. It relies on Windows process creation telemetry, matching on the executable name and required command-line substrings.
references:
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powercfg_execution.yml
author: frack113, Huntrule Team
date: 2022-11-18
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_power:
    - Image|endswith: \powercfg.exe
    - OriginalFileName: PowerCfg.exe
  selection_standby:
    - CommandLine|contains|all:
        - "/setacvalueindex "
        - SCHEME_CURRENT
        - SUB_VIDEO
        - VIDEOCONLOCK
    - CommandLine|contains|all:
        - "-change "
        - -standby-timeout-
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b
    type: derived