System Power Settings Modified to Prevent Sleep

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive strings "powercfg" and "change". This combination suggests an attempt to modify system power settings, potentially to prevent a system from sleeping or shutting down, which could be a persistence mechanism.