Techniques › T1529
T1529 System Shutdown/Reboot
impact — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
8
Sigma rules tagged attack.t1529
0
KEV CVEs mapped here
<p>Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. <code>reload</code>). They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.</p><p>Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.</p><p>Adversaries may also use Windows API functions, such as
InitializeSystemShutdownExW or ExitWindowsEx, to force a system to shut down or reboot. Alternatively, the NtRaiseHardErroror ZwRaiseHardError Windows API functions with the ResponseOption parameter set to OptionShutdownSystem may deliver a “blue screen of death” (BSOD) to a system. In order to leverage these API functions, an adversary may need to acquire SeShutdownPrivilege (e.g., via Access Token Manipulation). In some cases, the system may not be able to boot again.</p><p>Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as Disk Structure Wipe or Inhibit System Recovery, to hasten the intended effects on system availability.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0559 Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events v1.0
AN1538 WindowsCorrelate process execution of shutdown/reboot commands (e.g., shutdown.exe, restart-computer) with host status change logs (Event IDs 1074, 6006) and absence of related administrative context (e.g., user not in Helpdesk group).Tunable:
UserContextTimeWindowAN1539 LinuxDetect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.Tunable:CommandLineMatchUserContextAN1540 macOSIdentify use of 'shutdown', 'reboot', or 'osascript' system shutdown invocations within unified logs and track unexpected shutdown sequences initiated by GUI or script. Cross-reference with user activity or absence thereof.Tunable:LaunchMechanismLogGranularityAN1541 ESXiDetect commands such as 'esxcli system shutdown' or 'vim-cmd vmsvc/power.shutdown' executed outside of maintenance windows or via unusual users. Reboot logs in hostd.log and shell logs should be correlated.Tunable:AccountRoleMaintenanceWindowAN1542 Network DevicesMonitor CLI 'reload' commands issued without scheduled maintenance, and correlate to TACACS+/AAA logs for privilege validation.Tunable:PrivilegeLevelChangeTicketCorrelation
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1529
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · 2992ac4d-31e9-4325-99f2-b18a73221bb2
Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
Author: frack113
· 2022-01-01 · logsource: product=windows category=process_creation · 34ebb878-1b15-4895-b352-ca2eeb99b274
Use of the commandline to shutdown or reboot windows
Author: Alina Stepchenkova, Group-IB, oscd.community
· 2019-11-01 (modified 2023-04-03) · logsource: product=windows category=ps_script · 3ceb2083-a27f-449a-be33-14ec1b7cc973
Detects Silence EmpireDNSAgent as described in the Group-IP report
Author: Igor Fits, Mikhail Larin, oscd.community
· 2020-10-19 (modified 2022-11-26) · logsource: product=macos category=process_creation · 40b1fbe2-18ea-4ee7-be47-0294285811de
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Author: Igor Fits, oscd.community
· 2020-10-15 (modified 2022-11-26) · logsource: product=linux service=auditd · 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Author: Austin Clark
· 2019-08-15 (modified 2023-01-04) · logsource: product=cisco service=aaa · d94a35f0-7a29-45f6-90a0-80df6159967c
Detect a system being shutdown or put into different boot mode
Author: Milad Cheraghi
· 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Author: frack113
· 2022-10-01 · logsource: product=windows category=process_creation · ec290c06-9b6b-4338-8b6b-095c0f284f10
Detects the rare use of the command line tool shutdown to logoff a user