System Shutdown/Reboot T1529
Tactic: Impact
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. reload). They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.
Events covered
8 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| ESF | exec | Process Execution (Notify) |
| Linux-Auditd | Event ID 1302 | PATH |
| Linux-Auditd | Event ID 1309 | EXECVE |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| Sysmon-for-Linux | Event ID 1 | Process Create |
| User32 | Event ID 1074 | The process %1 has initiated the %5 of computer %2 on behalf of user %7 for the following reason: |
Authoring guide
Patterns shared across the 35 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (29 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (100 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (1 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 9 rules
- Cisco Denial of Service
- ESXi VM Kill Via ESXCLI
- macOS Service Disruption Activity
- Potential Abuse of Linux Magic System Request Key
- Silence.EDA Detection
- Suspicious Execution of Shutdown
- Suspicious Execution of Shutdown to Log Out
- System Shutdown/Reboot - Linux
- System Shutdown/Reboot - MacOs
Elastic 2 rules
Splunk 9 rules
- ESXi Bulk VM Termination
- Linux Magic SysRq Key Abuse
- Linux System Reboot Via System Request Key
- Microsoft Intune Manual Device Management
- System Shutdown or Reboot (Windows Event Log)
- Windows Common Abused Cmd Shell Risk Behavior
- Windows System LogOff Commandline
- Windows System Reboot CommandLine
- Windows System Shutdown CommandLine
Kusto 15 rules
- Azure secure score admin MFA
- Azure secure score one admin
- Azure secure score role overlap
- Azure Secure Score Self Service Password Reset
- Azure secure score sign in risk policy
- Azure secure score user risk policy
- Claroty - Asset Down
- Claroty - Critical baseline deviation
- OCI - Multiple instances terminated
- OracleDBAudit - Shutdown Server
- SenservaPro AD Applications Not Using Client Credentials
- VMware ESXi - Low patch disk space
- VMware ESXi - Low temp directory space
- VMware ESXi - Multiple VMs stopped
- VMware ESXi - VM stopped