add rule for impair system power settings

[CheraghiMilad]

Summary of the Pull Request

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity

Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.

Changelog

Rule:
index=* host="caldera-virtual-machine" type="EXECVE" AND a0="systemctl*" AND a1="mask" AND (a2="suspend.target" OR a2="hibernate.target" OR a2="hybrid-sleep.target")

hibernate.target log

<Events>
  <Event>
    <System>
      <Timestamp>11/24/24 3:24:29.304 PM</Timestamp>
      <Type>EXECVE</Type>
      <AuditID>1732449269.304:11435</AuditID>
      <Arguments>
        <Argument>systemctl</Argument>
        <Argument>mask</Argument>
        <Argument>hibernate.target</Argument>
      </Arguments>
      <Host>caldera-virtual-machine</Host>
      <Source>/var/log/audit/audit.log</Source>
      <SourceType>linux:audit</SourceType>
    </System>
  </Event>

suspend.target log

  <Event>
    <System>
      <Timestamp>11/24/24 3:24:13.744 PM</Timestamp>
      <Type>EXECVE</Type>
      <AuditID>1732449253.744:11301</AuditID>
      <Arguments>
        <Argument>systemctl</Argument>
        <Argument>mask</Argument>
        <Argument>suspend.target</Argument>
      </Arguments>
      <Host>caldera-virtual-machine</Host>
      <Source>/var/log/audit/audit.log</Source>
      <SourceType>linux:audit</SourceType>
    </System>
  </Event>
</Events>

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

LGTM