Cross-source coverage
T1529 / ATT&CK
System Shutdown/Reboot
From MITRE ATT&CK 19.2
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. reload). They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.
Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.
Adversaries may also use Windows API functions, such as InitializeSystemShutdownExW or ExitWindowsEx, to force a system to shut down or reboot. Alternatively, the NtRaiseHardErroror ZwRaiseHardError Windows API functions with the ResponseOption parameter set to OptionShutdownSystem may deliver a “blue screen of death” (BSOD) to a system. In order to leverage these API functions, an adversary may need to acquire SeShutdownPrivilege (e.g., via Access Token Manipulation).
In some cases, the system may not be able to boot again.
Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as Disk Structure Wipe or Inhibit System Recovery, to hasten the intended effects on system availability.
- Tactics
- Impact
- Platforms
- ESXi · Linux · macOS · Network Devices · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:syslogmacos:unifiedlogesxi:hostdesxi:shellnetworkdevice:syslog
How MITRE says to detect it DET0559
Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events
Windows Analytic 1538
Correlate process execution of shutdown/reboot commands (e.g., shutdown.exe, restart-computer) with host status change logs (Event IDs 1074, 6006) and absence of related administrative context (e.g., user not in Helpdesk group).
WinEventLog:SecurityEventCode=1074WinEventLog:SysmonEventCode=1
Linux Analytic 1539
Detect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.
auditd:SYSCALLexecve=/sbin/shutdown or /sbin/rebootlinux:syslogsystem is powering down
macOS Analytic 1540
Identify use of 'shutdown', 'reboot', or 'osascript' system shutdown invocations within unified logs and track unexpected shutdown sequences initiated by GUI or script. Cross-reference with user activity or absence thereof.
macos:unifiedlogshutdown -h now or rebootmacos:unifiedlogSystem shutdown or reboot requested
ESXi Analytic 1541
Detect commands such as 'esxcli system shutdown' or 'vim-cmd vmsvc/power.shutdown' executed outside of maintenance windows or via unusual users. Reboot logs in hostd.log and shell logs should be correlated.
esxi:hostdPowering off or restarting hostesxi:shellesxcli system shutdown or reboot invoked
Network Devices Analytic 1542
Monitor CLI 'reload' commands issued without scheduled maintenance, and correlate to TACACS+/AAA logs for privilege validation.
networkdevice:syslogreload command issuednetworkdevice:syslogSystem reboot scheduled or performed
Wazuh Core Ruleset
15 rules · 13 families| Detection | Severity | Format |
|---|---|---|
| MySQL: shutdown message. | High | Wazuh XML |
| PostgreSQL: Database shutdown message. 2 variants | High | Wazuh XML |
| PostgreSQL: Database shutdown message. 2 variants | High | Wazuh XML |
| IPsec Services has experienced a critical failure and has been shut down 2 variants | Medium | Wazuh XML |
| IPsec Services has experienced a critical failure and has been shut down 2 variants | Medium | Wazuh XML |
| System is shutting down. | Medium | Wazuh XML |
| Unexpected Windows shutdown. | Medium | Wazuh XML |
| User initiated shutdown | Medium | Wazuh XML |
| Virtual machine state changed to OFF. | Medium | Wazuh XML |
| Windows is shutting down | Medium | Wazuh XML |
+ 5 more from Wazuh Core Ruleset → showing the 10 highest-severity
socfortress/Wazuh-Rules
10 rules| Detection | Severity | Format |
|---|---|---|
| System reboot attempt via halt --reboot (MITRE T1529) | High | Wazuh XML |
| System reboot attempt via poweroff with reboot flag (MITRE T1529) | High | Wazuh XML |
| System reboot command executed via halt -r (T1529) | High | Wazuh XML |
| System reboot command executed via /sbin/reboot or /usr/sbin/reboot (T1529) | High | Wazuh XML |
| System restart attempt via shutdown -r now (T1529) | High | Wazuh XML |
| System shutdown attempt via poweroff command (MITRE T1529) | High | Wazuh XML |
| System shutdown command executed via halt -p (T1529) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · System Logoff (T1529) | Medium | Wazuh XML |
| Sysmon - Event 1: Process creation · System Restart (T1529) | Medium | Wazuh XML |
| Sysmon - Event 1: Process creation · System Shutdown (T1529) | Medium | Wazuh XML |
SigmaHQ/sigma
8 rules| Detection | Severity | Format |
|---|---|---|
| Silence.EDA Detection | Critical | Sigma |
| Cisco Denial of Service | Medium | Sigma |
| ESXi VM Kill Via ESXCLI | Medium | Sigma |
| Potential Abuse of Linux Magic System Request Key | Medium | Sigma |
| Suspicious Execution of Shutdown | Medium | Sigma |
| Suspicious Execution of Shutdown to Log Out | Medium | Sigma |
| System Shutdown/Reboot - Linux | Informational | Sigma |
| System Shutdown/Reboot - MacOs | Informational | Sigma |
splunk/security_content
8 rules| Detection | Severity | Format |
|---|---|---|
| ESXi Bulk VM Termination | Undefined | SPL |
| Linux Magic SysRq Key Abuse | Undefined | SPL |
| Linux System Reboot Via System Request Key | Undefined | SPL |
| Microsoft Intune Manual Device Management | Undefined | SPL |
| Windows Common Abused Cmd Shell Risk Behavior | Undefined | SPL |
| Windows System LogOff Commandline | Undefined | SPL |
| Windows System Reboot CommandLine | Undefined | SPL |
| Windows System Shutdown CommandLine | Undefined | SPL |
Azure/Azure-Sentinel
2 rules| Detection | Severity | Format |
|---|---|---|
| Windows System Shutdown/Reboot (Normalized Process Events) | Undefined | KQL |
| Windows System Shutdown/Reboot(Sysmon) | Undefined | KQL |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Azure Kubernetes Services (AKS) Kubernetes Pods Deleted | Medium | Elastic TOML |
| Azure Resource Group Deleted | Medium | Elastic TOML |