Power Settings (T1653) is a Persistence technique on Windows, Linux, macOS and network devices. Adversaries impair a system's ability to hibernate, reboot or shut down so access lasts longer. A dormant machine may stop the malware running on it.
How attackers use it
MITRE says adversaries abuse system utilities and settings to prevent standby and similar states. On Windows, powercfg controls power settings and can stop an infected host from locking or shutting down. Lock screen timeouts can be extended, and disk and hibernate timeouts can be abused the same way. Since some malware does not survive a reboot, adversaries may delete the files used to invoke shutdown or reboot.
On the page, ArcaneDoor involved forcing a Cisco ASA to reboot, which triggered unzipping and running the Line Runner implant. Line Dancer can alter the crash dump process to skip dump generation and go straight to reboot.
How to detect it
MITRE's analytics: on Windows, powercfg.exe with arguments that change sleep, hibernate or display timeouts, especially repeated changes outside administrative baselines. On Linux, systemctl, systemd-inhibit and edits to sleep configuration such as /etc/systemd/sleep.conf. On macOS, pmset commands and changes to the PowerManagement plist under Library/Preferences/SystemConfiguration.
How to reduce the risk
The MITRE mitigation is Audit: periodically inspect systems for abnormal and unexpected power settings.
Read-only checks:
# Windows
powercfg /query SCHEME_CURRENT SUB_SLEEP
# macOS
pmset -g custom
# Linux
cat /etc/systemd/sleep.conf
Compare results with your standard images, and enforce power settings through policy so deviations stand out.
Treat unexplained changes as a signal even when the setting looks harmless. A server that suddenly never sleeps, or a laptop with a lock timeout stretched far beyond policy, is worth a look at which process made the change and when. Pair setting audits with process creation logging so you can see who ran powercfg, pmset or systemctl.
Quick check
Why would malware prevent sleep?
When a computer goes dormant, malicious activity can stop, so keeping it awake extends access.
