Query: write Sigma for Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout
Matching passage: Sigma rule: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout. Logsource: windows / process_creation. Rule: title: Suspicious Powercfg Execution To Change Lock Screen Timeout id: f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b status: test description: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options author: frack113 date: 2022-11-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_power: - Image|endswith: \powercfg.exe - OriginalFileName: PowerCfg.exe selection_standby: - CommandLine|contains|all: - '/setacvalueindex ' - SCHEME_CURRENT - SUB_VIDEO - VIDEOCONLOCK - CommandLine|contains|all: - '-change ' - -standby-timeout- condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.. Logsource: windows / image_load. Rule: title: Suspicious WSMAN Provider Image Loads id: ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94 status: test description: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution. references: - https://twitter.com/chadtilbury/status/1275851297770610688 - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/ - https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture - https://github.com/bohops/WSMan-WinRM author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-24 modified: 2026-07-28 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: request_client: - ImageLoaded|endswith: - \WsmSvc.dll - \WsmAuto.dll - \Microsoft.WSMan.Management.ni.dll - OriginalFileName: - WsmSvc.dll - WSMANAUTOMATION.DLL - Microsoft.WSMan.Management.dll respond_server: Image|endswith: \svchost.exe OriginalFileName: WsmWmiPl.dll filter_general: Image: - C:\Program Files (x86)\PowerShell\6\pwsh.exe - C:\Program Files (x86)\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\6\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\sdiagnhost.exe - C:\Windows\System32\services.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe filter_svchost: CommandLine|contains: - svchost.exe -k netsvcs -p -s BITS - svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc - svchost.exe -k NetworkService -p -s Wecsvc - svchost.exe -k netsvcs filter_mscorsvw: Image|startswith: - C:\Windows\Microsoft.NET\Framework64\v - C:\Windows\Microsoft.NET\Framework\v - C:\Windows\Microsoft.NET\FrameworkArm\v - C:\Windows\Microsoft.NET\FrameworkArm64\v Image|endswith: \mscorsvw.exe filter_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_svr_2019: Image: - C:\Windows\System32\Configure-SMRemoting.exe - C:\Windows\System32\ServerManager.exe filter_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ filter_citrix: Image|startswith: C:\Program Files\Citrix\ filter_upgrade: Image|startswith: C:\$WINDOWS.~BT\Sources\ filter_mmc: Image|endswith: \mmc.exe svchost: Image|endswith: \svchost.exe commandline_null: CommandLine: null condition: ( request_client or respond_server ) and not 1 of filter* and not ( svchost and commandline_null ) f