Techniques › T1529 › AN1539
AN1539 Analytic 1539
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.</p>
- Detects
- T1529 System Shutdown/Reboot
- Part of
- DET0559 Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve=/sbin/shutdown or /sbin/reboot | DC0064 Command Execution |
| linux:syslog | system is powering down | DC0018 Host Status |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CommandLineMatch | Supports multiple binary names or symlinked utilities. |
UserContext | Privileged user (e.g., root or via sudo) context matching expected roles. |