Windows System Shutdown/Reboot (Normalized Process Events)

id: 614a59c5-2dae-4430-bb16-951a28a5f05f
name: Windows System Shutdown/Reboot (Normalized Process Events)
description: |
  'This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529)'

requiredDataConnectors: []

tactics:
  - Impact
relevantTechniques:
  - T1529

query: |
  let timeframe = 1d;
  imProcessCreate
  | where Process has "shutdown.exe" 
  | extend HostCustomEntity = Dvc, AccountCustomEntity = User

entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity