Suspicious Powercfg Execution to Change Lock Screen Timeout
This rule detects suspicious execution of 'Powercfg.exe' to modify power settings related to the lock screen timeout. Adversaries may use this technique to prevent a system from entering a dormant state, thereby maintaining access and hindering defensive mechanisms. The rule specifically looks for command-line arguments that change the AC (alternating current) or DC (direct current) standby timeout, or modify the video display timeout when the system is locked.
Sigma
