System Shutdown/Reboot T1529
Tactic: Impact
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. reload). They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.
Events covered
9 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| ESF | exec | Process Execution |
| Linux-Auditd | Event ID 1302 | PATH |
| Linux-Auditd | Event ID 1307 | CWD |
| Linux-Auditd | Event ID 1309 | EXECVE |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| Sysmon-for-Linux | Event ID 1 | Process Create |
| User32 | Event ID 1074 | The process %1 has initiated the %5 of computer %2 on behalf of user %7 for the following reason: |
Authoring guide
These 35 rules share fields, values, and exclusions.
Fields filtered most (27 distinct)
These fields appear most often in rule filters.
Top indicator values (98 distinct)
These values appear most often in rule predicates.
Exclusions (1 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 9 rules
- Cisco Denial of Service
- ESXi VM Kill Via ESXCLI
- macOS Service Disruption Activity
- Potential Abuse of Linux Magic System Request Key
- Silence.EDA Detection
- Suspicious Execution of Shutdown
- Suspicious Execution of Shutdown to Log Out
- System Shutdown/Reboot - Linux
- System Shutdown/Reboot - MacOs
Elastic 2 rules
Splunk 9 rules
- ESXi Bulk VM Termination
- Linux Magic SysRq Key Abuse
- Linux System Reboot Via System Request Key
- Microsoft Intune Manual Device Management
- System Shutdown or Reboot (Windows Event Log)
- Windows Common Abused Cmd Shell Risk Behavior
- Windows System LogOff Commandline
- Windows System Reboot CommandLine
- Windows System Shutdown CommandLine
Kusto 15 rules
- Azure secure score admin MFA
- Azure secure score one admin
- Azure secure score role overlap
- Azure Secure Score Self Service Password Reset
- Azure secure score sign in risk policy
- Azure secure score user risk policy
- Claroty - Asset Down
- Claroty - Critical baseline deviation
- OCI - Multiple instances terminated
- OracleDBAudit - Shutdown Server
- SenservaPro AD Applications Not Using Client Credentials
- VMware ESXi - Low patch disk space
- VMware ESXi - Low temp directory space
- VMware ESXi - Multiple VMs stopped
- VMware ESXi - VM stopped