T1653Persistence
Power Settings
Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity. Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports1
Detections
1 Sigma rule tagged T1653Power SettingsT16531 general rule
- Mask System Power Settings Via Systemctlhighexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Power Settings
1 CVE, by priority. Each link shows its badge.- CVE-2024-20353Cisco ASA and FTD Denial of Service VulnerabilityCisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVPublic exploitHigh · 8.6T1608.001Upload MalwareT1190Exploit Public-Facing Application+2 more · 2 reportsMITRE CTID mapping of the KEV entry · primary impact69.8%Top 0.63%85.0priority
Passages that support these links
The reboot action via CVE-2024-20353 (T1653),