Threat Hunt - Power Settings Manipulation
This hunting query detects adversaries attempting to impair or disable power-related functions in Windows environments. It covers explicit powercfg.exe commands, registry tampering of HibernateEnabled, deletion/modification of the hiberfil.sys file, and suspicious PowerShell usage. Such activity is often leveraged by attackers to maintain persistence or disrupt forensic evidence.
Microsoft Sentinel (KQL)
