TA0003 · PERSISTENCE
Power Settings
Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.
Detect it with
Command-line invocation of tools capable of modifying services may be unusual and can be monitored for and alerted on, depending on how systems are typically used in a particular environment.
Why it matters on shift
Power Settings is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context