Power Settings

{
  "id": "ATTACK:enterprise:T1653",
  "title": "Power Settings",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1653",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--ea071aa0-8f17-416f-ab0d-2bab7e79003d",
  "external_id": "T1653",
  "domain": "enterprise",
  "created": "2023-06-05T15:52:52.467Z",
  "modified": "2025-10-24T17:49:33.435Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "Sleep, shut down, hibernate",
      "url": "https://www.avg.com/en/signal/should-you-shut-down-sleep-or-hibernate-your-pc-or-mac-laptop"
    },
    {
      "source_name": "CoinLoader: A Sophisticated Malware Loader Campaign",
      "url": "https://www.avira.com/en/blog/coinloader-a-sophisticated-malware-loader-campaign"
    },
    {
      "source_name": "BATLOADER: The Evasive Downloader Malware",
      "url": "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html"
    },
    {
      "source_name": "Two New Monero Malware Attacks Target Windows and Android Users",
      "url": "https://securityintelligence.com/news/two-new-monero-malware-attacks-target-windows-and-android-users/"
    },
    {
      "source_name": "Condi-Botnet-binaries",
      "url": "https://www.fortinet.com/blog/threat-research/condi-ddos-botnet-spreads-via-tp-links-cve-2023-1389"
    },
    {
      "source_name": "systemdsleep Linux",
      "url": "https://man7.org/linux/man-pages/man5/systemd-sleep.conf.5.html"
    },
    {
      "source_name": "Microsoft: Powercfg command-line options",
      "url": "https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options?adlt=strict"
    }
  ]
}