Disable power options

 1title: Disable power options
 2status: experimental
 3description: Disable power options
 4author: Joe Security
 5date: 2024-03-11
 6id: 200114
 7threatname:
 8behaviorgroup: 31
 9classification: 8
10mitreattack: 
11
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        CommandLine:
18            - '*powercfg.exe /x -monitor-timeout-ac 0'
19            - '*powercfg.exe /x -monitor-timeout-dc 0'
20            - '*powercfg.exe /x -disk-timeout-ac 0'
21            - '*powercfg.exe /x -disk-timeout-dc 0'
22            - '*powercfg.exe /x -standby-timeout-ac 0'
23            - '*powercfg.exe /x -standby-timeout-dc 0'
24            - '*powercfg.exe /x -hibernate-timeout-ac 0'
25            - '*powercfg.exe /x -hibernate-timeout-dc 0'           
26            
27    condition: selection
28level: critical