Detection rules › Splunk

System Shutdown or Reboot (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine

MITRE ATT&CK coverage

TacticTechniques
Impact

References

Telemetry coverage

Rule body

id: '8106.10012'
title: System Shutdown or Reboot
description: 'Adversaries may shutdown/reboot systems to interrupt access to, or aid
  in the destruction of, those systems. Operating systems may contain commands to
  initiate a shutdown/reboot of a machine. -- Software Association: Blackbyte, Conti,
  DirtyMoe'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=1074) OR
  "<EventID>1074<") | rex field=Message "(?i)process\s+(?<process_name>.*?\.(exe|dll|\w{2,4}))"|
  rex field=Message "user\s+(?<user>.*?\x5c\S+)" | eval shutdown_type=Shutdown_Type
  | table _time, host, user process_name, shutdown_type, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- impact:system shutdown/reboot
technique_id: 
- T1529
data_category:
- Windows event logs
references:
- https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=1074) OR "<EventID>1074<")

Stage 2: rex

| rex field=Message "(?i)process\s+(?<process_name>.*?\.(exe|dll|\w{2,4}))"

Stage 3: rex

| rex field=Message "user\s+(?<user>.*?\x5c\S+)"

The parser skipped this rex command.

Stage 4: eval

| eval shutdown_type=Shutdown_Type

Stage 5: table

| table _time, host, user process_name, shutdown_type, signature_id

Stage 6: bucket

| bin span=1s

Stage 7: stats

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Search terms

These SPL tokens match against raw event text.

StageTerm
1"<EventID>1074<"