Sigma rule: Mask System Power Settings Via Systemctl

Rule

Title

Mask System Power Settings Via Systemctl

Status

experimental

Level

high

Author

Milad Cheraghi, Nasreddine Bencherchali

Date

2025-10-17

File

rules/linux/process_creation/proc_creation_lnx_systemctl_mask_power_settings.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.

Log source

product

linux

category

process_creation

Detection

selection_systemctl:
    Image|endswith: '/systemctl'
    CommandLine|contains: ' mask'
selection_power_options:
    CommandLine|contains:
        - 'suspend.target'
        - 'hibernate.target'
        - 'hybrid-sleep.target'
condition: all of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.persistence
• attack.impact
• attack.t1653

MITRE ATT&CK ids this rule names

• T1653

References

• https://www.man7.org/linux/man-pages/man1/systemctl.1.html
• https://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_systemctl_mask_power_settings.yml