Query: detect Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep in logs
Matching passage: Sigma rule: Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Logsource: linux / process_creation. Rule: title: Mask System Power Settings Via Systemctl id: c172b7b5-f3a1-4af2-90b7-822c63df86cb status: experimental description: 'Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity. ' author: Milad Cheraghi, Nasreddine Bencherchali date: 2025-10-17 references: - https://www.man7.org/linux/man-pages/man1/systemctl.1.html - https://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/ tags: - attack.persistence - attack.impact - attack.t1653 logsource: category: process_creation product: linux detection: selection_systemctl: Image|endswith: /systemctl CommandLine|contains: ' mask' selection_power_options: CommandLine|contains: - suspend.target - hibernate.target - hybrid-sleep.target condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects BITS transfer job downloading files from a file sharing domain.. Logsource: windows / bits-client. Rule: title: BITS Transfer Job Download From File Sharing Domains id: d635249d-86b5-4dad-a8c7-d7272b788586 related: - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: Detects BITS transfer job downloading files from a file sharing domain. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md - https://twitter.com/malmoeb/status/1535142803075960832 - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/ author: Florian Roth (Nextron Systems) date: 2022-06-28 modified: 2026-03-29 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 RemoteName|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at condition: selection falsepositives: - Unknown level: high