{"id":"T1529","name":"System Shutdown/Reboot","url":"https://attack.mitre.org/techniques/T1529","tactics":["impact"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0559","stix_id":"x-mitre-detection-strategy--2a464ecb-46ef-41f0-8ab6-a97a99ad0559","name":"Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events","url":"https://attack.mitre.org/detectionstrategies/DET0559","analytics":[{"id":"AN1538","stix_id":"x-mitre-analytic--52b9bf67-304e-403f-9b81-4d4b9d974ad6","name":"Analytic 1538","description":"Correlate process execution of shutdown/reboot commands (e.g., shutdown.exe, restart-computer) with host status change logs (Event IDs 1074, 6006) and absence of related administrative context (e.g., user not in Helpdesk group).","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1538","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=1074","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"UserContext","description":"Defines if user has appropriate privileges to initiate shutdown/reboot."},{"field":"TimeWindow","description":"Unexpected shutdowns during business hours may warrant increased scrutiny."}],"live":true,"detection_strategies":["DET0559"],"techniques":["T1529"]},{"id":"AN1539","stix_id":"x-mitre-analytic--f1a019df-12f0-442e-9b0e-b1a82352389b","name":"Analytic 1539","description":"Detect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1539","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve=/sbin/shutdown or /sbin/reboot","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"system is powering down","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"CommandLineMatch","description":"Supports multiple binary names or symlinked utilities."},{"field":"UserContext","description":"Privileged user (e.g., root or via sudo) context matching expected roles."}],"live":true,"detection_strategies":["DET0559"],"techniques":["T1529"]},{"id":"AN1540","stix_id":"x-mitre-analytic--6b11c208-4dbf-4d52-9254-524e622c6250","name":"Analytic 1540","description":"Identify use of 'shutdown', 'reboot', or 'osascript' system shutdown invocations within unified logs and track unexpected shutdown sequences initiated by GUI or script. Cross-reference with user activity or absence thereof.","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1540","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"shutdown -h now or reboot","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"System shutdown or reboot requested","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"LaunchMechanism","description":"Scripted vs interactive shutdowns."},{"field":"LogGranularity","description":"May vary depending on macOS version and unified log verbosity."}],"live":true,"detection_strategies":["DET0559"],"techniques":["T1529"]},{"id":"AN1541","stix_id":"x-mitre-analytic--d076faf3-c5bd-4e5c-93a5-8408c9e80fe1","name":"Analytic 1541","description":"Detect commands such as 'esxcli system shutdown' or 'vim-cmd vmsvc/power.shutdown' executed outside of maintenance windows or via unusual users. Reboot logs in hostd.log and shell logs should be correlated.","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1541","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"Powering off or restarting host","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"esxi-hostd"},{"name":"esxi:shell","channel":"esxcli system shutdown or reboot invoked","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"}],"mutable_elements":[{"field":"AccountRole","description":"Administrative account context validation."},{"field":"MaintenanceWindow","description":"Expected times for reboot/shutdown behavior."}],"live":true,"detection_strategies":["DET0559"],"techniques":["T1529"]},{"id":"AN1542","stix_id":"x-mitre-analytic--9c70d5b3-8748-4f88-8fd8-95f79c73d250","name":"Analytic 1542","description":"Monitor CLI 'reload' commands issued without scheduled maintenance, and correlate to TACACS+/AAA logs for privilege validation.","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1542","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"reload command issued","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"},{"name":"networkdevice:syslog","channel":"System reboot scheduled or performed","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"PrivilegeLevel","description":"TACACS+/AAA role thresholds for command execution."},{"field":"ChangeTicketCorrelation","description":"Track change control windows or ITSM integration."}],"live":true,"detection_strategies":["DET0559"],"techniques":["T1529"]}],"live":true,"version":"1.0","techniques":["T1529"]}],"sigma_rules":[{"id":"2992ac4d-31e9-4325-99f2-b18a73221bb2","title":"ESXi VM Kill Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"vm\" and \"kill\" flag in order to kill/shutdown a specific VM.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html","https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/","https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.impact","attack.t1059.012","attack.t1529"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml","techniques":["T1059.012","T1529"],"cves":[]},{"id":"34ebb878-1b15-4895-b352-ca2eeb99b274","title":"Suspicious Execution of Shutdown","author":"frack113","status":"test","level":"medium","date":"2022-01-01","modified":null,"description":"Use of the commandline to shutdown or reboot windows","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1529"],"path":"rules/windows/process_creation/proc_creation_win_shutdown_execution.yml","techniques":["T1529"],"cves":[]},{"id":"3ceb2083-a27f-449a-be33-14ec1b7cc973","title":"Silence.EDA Detection","author":"Alina Stepchenkova, Group-IB, oscd.community","status":"test","level":"critical","date":"2019-11-01","modified":"2023-04-03","description":"Detects Silence EmpireDNSAgent as described in the Group-IP report","references":["https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.command-and-control","attack.t1071.004","attack.t1572","attack.impact","attack.t1529","attack.g0091","attack.s0363"],"path":"rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml","techniques":["T1059.001","T1071.004","T1572","T1529"],"cves":[]},{"id":"40b1fbe2-18ea-4ee7-be47-0294285811de","title":"System Shutdown/Reboot - MacOs","author":"Igor Fits, Mikhail Larin, oscd.community","status":"test","level":"informational","date":"2020-10-19","modified":"2022-11-26","description":"Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.impact","attack.t1529"],"path":"rules/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml","techniques":["T1529"],"cves":[]},{"id":"4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f","title":"System Shutdown/Reboot - Linux","author":"Igor Fits, oscd.community","status":"test","level":"informational","date":"2020-10-15","modified":"2022-11-26","description":"Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.impact","attack.t1529"],"path":"rules/linux/auditd/execve/lnx_auditd_system_shutdown_reboot.yml","techniques":["T1529"],"cves":[]},{"id":"d94a35f0-7a29-45f6-90a0-80df6159967c","title":"Cisco Denial of Service","author":"Austin Clark","status":"test","level":"medium","date":"2019-08-15","modified":"2023-01-04","description":"Detect a system being shutdown or put into different boot mode","references":[],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.impact","attack.t1495","attack.t1529","attack.t1565.001"],"path":"rules/network/cisco/aaa/cisco_cli_dos.yml","techniques":["T1495","T1529","T1565.001"],"cves":[]},{"id":"ea61bb82-a5e0-42e6-8537-91d29500f1b9","title":"Potential Abuse of Linux Magic System Request Key","author":"Milad Cheraghi","status":"experimental","level":"medium","date":"2025-05-23","modified":null,"description":"Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges\nto silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,\nor disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be\nmisused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.\n","references":["https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt","https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel","https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.execution","attack.t1059.004","attack.impact","attack.t1529","attack.t1489","attack.t1499"],"path":"rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml","techniques":["T1059.004","T1529","T1489","T1499"],"cves":[]},{"id":"ec290c06-9b6b-4338-8b6b-095c0f284f10","title":"Suspicious Execution of Shutdown to Log Out","author":"frack113","status":"test","level":"medium","date":"2022-10-01","modified":null,"description":"Detects the rare use of the command line tool shutdown to logoff a user","references":["https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1529/T1529.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1529"],"path":"rules/windows/process_creation/proc_creation_win_shutdown_logoff.yml","techniques":["T1529"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}