CmdID

CmdID / Commands

powercfg

Configure power settings and manage power schemes. tldr-pages

On Windows 1 Sigma rule name it File powercfg.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Display the current power scheme

powercfg /getactiveschemeIdentify

List all available power schemes

powercfg [/LIdentify

Set the active power scheme by its GUID

powercfg /setactive guidIdentify

Turn off the display after a specific number of minutes on AC power

powercfg [/X monitor-timeout-ac minutesIdentify

Turn off the display after a specific number of minutes on battery power

powercfg [/X monitor-timeout-dc minutesIdentify

Put the system to sleep after a specific number of minutes on AC power

powercfg [/X standby-timeout-ac minutesIdentify

Generate a system sleep diagnostics report and save it to a file

powercfg /sleepstudy /output path\to\report.htmlIdentify

Generate a full power efficiency report and save it to a file

powercfg /energy /output path\to\report.htmlIdentify

What detects it

Sigma process creation rules that name powercfg
mediumSuspicious Powercfg Execution To Change Lock Screen Timeoutfrack113