{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1529","id":"T1529","name":"System Shutdown/Reboot","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1529","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"22712df972c526fa831d8eb2022c241fd45ab7b815e9196b52be012b8af114f2","description":"Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. <code>reload</code>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.\n\nShutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.\n\nAdversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)\n In some cases, the system may not be able to boot again. \n\nAdversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1529","external_id":"T1529"},{"source_name":"Talos Nyetya June 2017","description":"Chiu, A. (2016, June 27). New Ransomware Variant \"Nyetya\" Compromises Systems Worldwide. Retrieved March 26, 2019.","url":"https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"},{"source_name":"alert_TA18_106A","description":"CISA. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved February 14, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/TA18-106A"},{"source_name":"NotMe-BSOD","description":"lzcapp. (n.d.). Retrieved September 22, 2025.","url":"https://github.com/lzcapp/NotMe-BSOD"},{"source_name":"Talos Olympic Destroyer 2018","description":"Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"},{"source_name":"Microsoft Shutdown Oct 2017","description":"Microsoft. (2017, October 15). Shutdown. Retrieved October 4, 2019.","url":"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown"},{"source_name":"NtRaiseHardError","description":"NtDoc. (n.d.). NtRaiseHardError - NtDoc. Retrieved September 22, 2025.","url":"https://ntdoc.m417z.com/ntraiseharderror"},{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"},{"source_name":"SonicWall","description":"SecurityNews. (2024, July 12). Disarming DarkGate: A Deep Dive into Thwarting the Latest DarkGate Variant. Retrieved September 22, 2025.","url":"https://www.sonicwall.com/blog/disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant"},{"source_name":"CrowdStrike Blog","description":"William Thomas, Adrian Liviu Arsene, Farid Hendi. (2022, February 25). CrowdStrike Falcon® Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved September 22, 2025.","url":"https://www.crowdstrike.com/en-us/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0018","name":"Host Status","page":"telemetry/DC0018/","kind":"attack_component","category":"Host state and inventory","description":"Host health and availability observations such as heartbeat, shutdown or degraded state.","collection_focus":"Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","status","heartbeat_age_seconds","collector_healthy"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1529","id":"T1529","name":"System Shutdown/Reboot","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1529","technique_page":"techniques/enterprise/T1529/","page":"detections/enterprise/T1529/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f","title":"System Shutdown/Reboot - Linux","status":"test","level":"informational","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_system_shutdown_reboot.yml","author":"Igor Fits, oscd.community","kind":"sigma"},{"id":"ea61bb82-a5e0-42e6-8537-91d29500f1b9","title":"Potential Abuse of Linux Magic System Request Key","status":"experimental","level":"medium","logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-w /proc/sysrq-trigger -p wa -k sysrq\n-w /proc/sys/kernel/sysrq -p wa -k sysrq\n"},"data_path":"data/detection-rules/ea61bb82-a5e0-42e6-8537-91d29500f1b9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml","author":"Milad Cheraghi","kind":"sigma"},{"id":"2992ac4d-31e9-4325-99f2-b18a73221bb2","title":"ESXi VM Kill Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/2992ac4d-31e9-4325-99f2-b18a73221bb2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","kind":"sigma"},{"id":"40b1fbe2-18ea-4ee7-be47-0294285811de","title":"System Shutdown/Reboot - MacOs","status":"test","level":"informational","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/40b1fbe2-18ea-4ee7-be47-0294285811de.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml","author":"Igor Fits, Mikhail Larin, oscd.community","kind":"sigma"},{"id":"d94a35f0-7a29-45f6-90a0-80df6159967c","title":"Cisco Denial of Service","status":"test","level":"medium","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/d94a35f0-7a29-45f6-90a0-80df6159967c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_dos.yml","author":"Austin Clark","kind":"sigma"},{"id":"3ceb2083-a27f-449a-be33-14ec1b7cc973","title":"Silence.EDA Detection","status":"test","level":"critical","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/3ceb2083-a27f-449a-be33-14ec1b7cc973.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml","author":"Alina Stepchenkova, Group-IB, oscd.community","kind":"sigma"},{"id":"34ebb878-1b15-4895-b352-ca2eeb99b274","title":"Suspicious Execution of Shutdown","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/34ebb878-1b15-4895-b352-ca2eeb99b274.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_shutdown_execution.yml","author":"frack113","kind":"sigma"},{"id":"ec290c06-9b6b-4338-8b6b-095c0f284f10","title":"Suspicious Execution of Shutdown to Log Out","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ec290c06-9b6b-4338-8b6b-095c0f284f10.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_shutdown_logoff.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0559","name":"Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events","url":"https://attack.mitre.org/detectionstrategies/DET0559","stix_id":"x-mitre-detection-strategy--2a464ecb-46ef-41f0-8ab6-a97a99ad0559","relationship_id":"relationship--a50b52d6-3634-4b87-8169-673ec219ce0b","description":"","analytics":[{"id":"AN1538","name":"Analytic 1538","guidance":"Correlate process execution of shutdown/reboot commands (e.g., shutdown.exe, restart-computer) with host status change logs (Event IDs 1074, 6006) and absence of related administrative context (e.g., user not in Helpdesk group).","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1538","platforms":["Windows"],"tuning":[{"field":"UserContext","description":"Defines if user has appropriate privileges to initiate shutdown/reboot."},{"field":"TimeWindow","description":"Unexpected shutdowns during business hours may warrant increased scrutiny."}],"log_sources":[{"component_id":"DC0018","component":"Host Status","name":"WinEventLog:Security","channel":"EventCode=1074","platforms":["Windows"],"analytic_id":"AN1538","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1538","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1538","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1538","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1539","name":"Analytic 1539","guidance":"Detect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1539","platforms":["Linux"],"tuning":[{"field":"CommandLineMatch","description":"Supports multiple binary names or symlinked utilities."},{"field":"UserContext","description":"Privileged user (e.g., root or via sudo) context matching expected roles."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execve=/sbin/shutdown or /sbin/reboot","platforms":["Linux"],"analytic_id":"AN1539","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1539","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0018","component":"Host Status","name":"linux:syslog","channel":"system is powering down","platforms":["Linux"],"analytic_id":"AN1539","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1539","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"}]},{"id":"AN1540","name":"Analytic 1540","guidance":"Identify use of 'shutdown', 'reboot', or 'osascript' system shutdown invocations within unified logs and track unexpected shutdown sequences initiated by GUI or script. Cross-reference with user activity or absence thereof.","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1540","platforms":["macOS"],"tuning":[{"field":"LaunchMechanism","description":"Scripted vs interactive shutdowns."},{"field":"LogGranularity","description":"May vary depending on macOS version and unified log verbosity."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"shutdown -h now or reboot","platforms":["macOS"],"analytic_id":"AN1540","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1540","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0018","component":"Host Status","name":"macos:unifiedlog","channel":"System shutdown or reboot requested","platforms":["macOS"],"analytic_id":"AN1540","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1540","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"}]},{"id":"AN1541","name":"Analytic 1541","guidance":"Detect commands such as 'esxcli system shutdown' or 'vim-cmd vmsvc/power.shutdown' executed outside of maintenance windows or via unusual users. Reboot logs in hostd.log and shell logs should be correlated.","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1541","platforms":["ESXi"],"tuning":[{"field":"AccountRole","description":"Administrative account context validation."},{"field":"MaintenanceWindow","description":"Expected times for reboot/shutdown behavior."}],"log_sources":[{"component_id":"DC0018","component":"Host Status","name":"esxi:hostd","channel":"Powering off or restarting host","platforms":["ESXi"],"analytic_id":"AN1541","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1541","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"esxcli system shutdown or reboot invoked","platforms":["ESXi"],"analytic_id":"AN1541","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1541","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1542","name":"Analytic 1542","guidance":"Monitor CLI 'reload' commands issued without scheduled maintenance, and correlate to TACACS+/AAA logs for privilege validation.","url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1542","platforms":["Network Devices"],"tuning":[{"field":"PrivilegeLevel","description":"TACACS+/AAA role thresholds for command execution."},{"field":"ChangeTicketCorrelation","description":"Track change control windows or ITSM integration."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"reload command issued","platforms":["Network Devices"],"analytic_id":"AN1542","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1542","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0018","component":"Host Status","name":"networkdevice:syslog","channel":"System reboot scheduled or performed","platforms":["Network Devices"],"analytic_id":"AN1542","source_url":"https://attack.mitre.org/detectionstrategies/DET0559#AN1542","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0018","name":"Host Status","tag":"Host Status","page":"telemetry/DC0018/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) will reboot the infected system once the wiping functionality has been completed.(Citation: Unit 42 Shamoon3 2018)(Citation: McAfee Shamoon December 2018)\t","relationship_id":"relationship--d2ff2c76-04ed-41c4-bd35-75f7cf823aee","references":[{"source_name":"Unit 42 Shamoon3 2018","description":"Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.","url":"https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"},{"source_name":"McAfee Shamoon December 2018","description":"Mundo, A., Roccia, T., Saavedra-Morales, J., Beek, C.. (2018, December 14). Shamoon Returns to Wipe Systems in Middle East, Europe . Retrieved May 29, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can shutdown and restart remote devices.(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--e87ba6d8-8228-45af-b235-54a0e0666a23","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0365","name":"Olympic Destroyer","url":"https://attack.mitre.org/software/S0365","kind":"malware","description":"[Olympic Destroyer](https://attack.mitre.org/software/S0365) will shut down the compromised system after it is done modifying system configuration settings.(Citation: Talos Olympic Destroyer 2018)(Citation: US District Court Indictment GRU Unit 74455 October 2020)","relationship_id":"relationship--4932951a-b313-4024-bbad-434de3b747c5","references":[{"source_name":"Talos Olympic Destroyer 2018","description":"Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"S0368","name":"NotPetya","url":"https://attack.mitre.org/software/S0368","kind":"malware","description":"[NotPetya](https://attack.mitre.org/software/S0368) will reboot the system one hour after infection.(Citation: Talos Nyetya June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)","relationship_id":"relationship--aa158d48-a9f5-49bb-8f15-166705f29b36","references":[{"source_name":"Talos Nyetya June 2017","description":"Chiu, A. (2016, June 27). New Ransomware Variant \"Nyetya\" Compromises Systems Worldwide. Retrieved March 26, 2019.","url":"https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"S0372","name":"LockerGoga","url":"https://attack.mitre.org/software/S0372","kind":"malware","description":"[LockerGoga](https://attack.mitre.org/software/S0372) has been observed shutting down infected systems.(Citation: Wired Lockergoga 2019)","relationship_id":"relationship--3c7bb2a4-eede-4dae-ac41-03782729a961","references":[{"source_name":"Wired Lockergoga 2019","description":"Greenberg, A. (2019, March 25). A Guide to LockerGoga, the Ransomware Crippling Industrial Firms. Retrieved July 17, 2019.","url":"https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.(Citation: Sophos Maze VM September 2020)","relationship_id":"relationship--62c1a647-4a39-45b1-8d68-99b19ec12a78","references":[{"source_name":"Sophos Maze VM September 2020","description":"Brandt, A., Mackenzie, P.. (2020, September 17). Maze Attackers Adopt Ragnar Locker Virtual Machine Technique. Retrieved October 9, 2020.","url":"https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"}]},{"id":"S0582","name":"LookBack","url":"https://attack.mitre.org/software/S0582","kind":"malware","description":"[LookBack](https://attack.mitre.org/software/S0582) can shutdown and reboot the victim machine.(Citation: Proofpoint LookBack Malware Aug 2019)","relationship_id":"relationship--66d53000-135b-448d-988a-3ff5d53b2c5b","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","description":"Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) attempts to reboot the machine by terminating specific processes.(Citation: Trend Micro KillDisk 2)","relationship_id":"relationship--9d6c5d09-94b9-4453-a26d-8b3ac79cfe7f","references":[{"source_name":"Trend Micro KillDisk 2","description":"Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.","url":"https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.(Citation: Cisco Ukraine Wipers January 2022)","relationship_id":"relationship--97453382-d064-4705-9a63-b21356d4bfce","references":[{"source_name":"Cisco Ukraine Wipers January 2022","description":"Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) can initiate a system shutdown.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Qualys Hermetic Wiper March 2022)","relationship_id":"relationship--f86b3fe5-c004-4fed-aaac-cf7d68b8d315","references":[{"source_name":"SentinelOne Hermetic Wiper February 2022","description":"Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022.","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Qualys Hermetic Wiper March 2022","description":"Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"}]},{"id":"S1033","name":"DCSrv","url":"https://attack.mitre.org/software/S1033","kind":"malware","description":"[DCSrv](https://attack.mitre.org/software/S1033) has a function to sleep for two hours before rebooting the system.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--0ef5c336-794e-4700-b40e-c78eed74d353","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053)’s Linux variant has terminated ESXi virtual machines.(Citation: Trend Micro AvosLocker Apr 2022)","relationship_id":"relationship--fc89b538-26d8-434a-954f-e7d0b384b506","references":[{"source_name":"Trend Micro AvosLocker Apr 2022","description":"Trend Micro Research. (2022, April 4). Ransomware Spotlight AvosLocker. Retrieved January 11, 2023.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) has used `ShellExecuteA` to shut down and restart the victim system.(Citation: Trend Micro Black Basta May 2022) ","relationship_id":"relationship--d82f1883-45a6-4b1e-ab7c-e5a3342a3cb9","references":[{"source_name":"Trend Micro Black Basta May 2022","description":"Gonzalez, I., Chavez I., et al. (2022, May 9). Examining the Black Basta Ransomware’s Infection Routine. Retrieved March 7, 2023.","url":"https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) has used the `shutdown`command to shut down and/or restart the victim system.(Citation: Rapid7 BlackBasta 2024) ","relationship_id":"relationship--d82bfd25-1dab-45a6-ad66-1eeb6190a63a","references":[{"source_name":"Rapid7 BlackBasta 2024","description":"McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024.","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}]},{"id":"S1125","name":"AcidRain","url":"https://attack.mitre.org/software/S1125","kind":"malware","description":"[AcidRain](https://attack.mitre.org/software/S1125) reboots the target system once the various wiping processes are complete.(Citation: AcidRain JAGS 2022)","relationship_id":"relationship--098c0f13-e56f-43ff-8fee-0cce9d771092","references":[{"source_name":"AcidRain JAGS 2022","description":"Juan Andres Guerrero-Saade and Max van Amerongen, SentinelOne. (2022, March 31). AcidRain | A Modem Wiper Rains Down on Europe. Retrieved March 25, 2024.","url":"https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/"}]},{"id":"S1133","name":"Apostle","url":"https://attack.mitre.org/software/S1133","kind":"malware","description":"[Apostle](https://attack.mitre.org/software/S1133) reboots the victim machine following wiping and related activity.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--6a8c7cab-bdf7-43dc-960b-84f47767f2df","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1135","name":"MultiLayer Wiper","url":"https://attack.mitre.org/software/S1135","kind":"malware","description":"[MultiLayer Wiper](https://attack.mitre.org/software/S1135) reboots the infected system following wiping and related tasks to prevent system recovery.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--20d59bcb-04cd-4581-a18f-4f77dd96027c","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"S1136","name":"BFG Agonizer","url":"https://attack.mitre.org/software/S1136","kind":"malware","description":"[BFG Agonizer](https://attack.mitre.org/software/S1136) uses elevated privileges to call <code>NtRaiseHardError</code> to induce a \"blue screen of death\" on infected systems, causing a system crash. Once shut down, the system is no longer bootable.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--17b73eb6-f4a6-49d4-8f72-18796cf7d553","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can reboot or shutdown the targeted system or logoff the current user.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--b153b867-6888-4071-bf34-d40305ca4150","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"\n[Latrodectus](https://attack.mitre.org/software/S1160) has the ability to restart compromised hosts.(Citation: Elastic Latrodectus May 2024)","relationship_id":"relationship--aba4a71f-ddee-428b-a454-9842fd8750fd","references":[{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S1167","name":"AcidPour","url":"https://attack.mitre.org/software/S1167","kind":"malware","description":"[AcidPour](https://attack.mitre.org/software/S1167) includes functionality to reboot the victim system following wiping actions, similar to [AcidRain](https://attack.mitre.org/software/S1125).(Citation: SentinelOne AcidPour 2024)","relationship_id":"relationship--30c9b855-cb8e-43ab-8f4c-ffef015789d6","references":[{"source_name":"SentinelOne AcidPour 2024","description":"Juan Andrés Guerrero-Saade & Tom Hegel. (2024, March 21). AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine. Retrieved November 25, 2024.","url":"https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) can restart the victim system if it encounters an error during execution, and will forcibly shutdown the system following encryption to lock out victim users.(Citation: Kaspersky ShrinkLocker 2024)","relationship_id":"relationship--a6bb7182-2459-406d-89c1-51b20f1a88f7","references":[{"source_name":"Kaspersky ShrinkLocker 2024","description":"Cristian Souza, Eduardo Ovalle, Ashley Muñoz, & Christopher Zachor. (2024, May 23). ShrinkLocker: Turning BitLocker into ransomware. Retrieved December 7, 2024.","url":"https://securelist.com/ransomware-abuses-bitlocker/112643/"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) can initiate a system reboot or shutdown.(Citation: Google XLoader 2017)","relationship_id":"relationship--a506c8b0-572d-470f-b90b-146a81385d13","references":[{"source_name":"Google XLoader 2017","description":"Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can initiate a reboot of the backup server to hinder recovery.(Citation: Picus Qilin MAR 2025)","relationship_id":"relationship--1caaad2f-7a84-4e32-8134-edac0c4fcc72","references":[{"source_name":"Picus Qilin MAR 2025","description":"Hacioglu, S. (2025, March 10). Qilin Ransomware: Exposing the TTPs Behind One of the Most Active Ransomware Campaigns of 2024. Retrieved September 26, 2025.","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"}]},{"id":"S9038","name":"DynoWiper","url":"https://attack.mitre.org/software/S9038","kind":"malware","description":"[DynoWiper](https://attack.mitre.org/software/S9038) has used the Microsoft Windows native `ExitWindowsEx()` function to log off the interactive user and shutdown the system.(Citation: CERT Polska)","relationship_id":"relationship--13ff8433-97c7-40c3-a082-812453731bf2","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) has forced the target system to reboot after file deletion.(Citation: Aikido CanisterWorm MAR 2026)","relationship_id":"relationship--394fe21a-c7a6-4571-abf5-03377b934634","references":[{"source_name":"Aikido CanisterWorm MAR 2026","description":"Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has conducted clean shutdowns of running VMs in ESXI environments using `vim-cmd vmsvc/power.off <vmid> > /dev/null 2>&1`. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also forcibly terminated running VM processes using `esxcli vm process kill --type=force --world-id=<world_id> > /dev/null 2>&1`.(Citation: CheckPointResearch_TheGentlemen_April2026) ","relationship_id":"relationship--5978688d-f172-4af5-bfc6-f62789492766","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"}]}],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has rebooted systems after destroying files and wiping the MBR on infected systems.(Citation: US-CERT SHARPKNOT June 2018)","relationship_id":"relationship--cc31afad-6349-4b66-a0a9-cd8f9de46aec","references":[{"source_name":"US-CERT SHARPKNOT June 2018","description":"US-CERT. (2018, March 09). Malware Analysis Report (MAR) - 10135536.11.WHITE. Retrieved June 13, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067) has used malware that will issue the command <code>shutdown /r /t 1</code> to reboot a system after wiping its MBR.(Citation: Talos Group123)","relationship_id":"relationship--63759ea4-5bf1-408d-a1cc-e7f52e3aca1b","references":[{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.(Citation: FireEye APT38 Oct 2018)","relationship_id":"relationship--53c8e757-8043-4d08-8bd6-8d02d2b973cb","references":[{"source_name":"FireEye APT38 Oct 2018","description":"FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has manually turned off and encrypted virtual machines.(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--dc81d3d6-c3e6-4f95-8143-e2da3ab5232a","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]}],"mitigations":[],"candidates":[{"id":"189f7d6e-9442-4160-9bc3-5e4104d93ece","name":"ESXi - Avoslocker enumerates VMs and forcefully kills VMs","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"Avoslocker malware has inbuilt functionality to enumerate the VM instances and uses the esxcli command to forcefully power off them.\n[Reference](https://blogs.vmware.com/security/2022/02/avoslocker-modern-linux-ransomware-threats.html)\n","inputs":{"vm_host":{"description":"Specify the host name of the ESXi Server","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on ESXi Server","type":"string","default":"root"},"vm_pass":{"description":"Specify the privilege user password on ESXi Server","type":"string","default":"pass"},"plink_file":{"description":"Path to plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"},"cli_script":{"description":"Path to text with commands","type":"path","default":"PathToAtomicsFolder\\T1529\\src\\esx_avoslocker_kill_vm.txt"}},"dependencies":[{"description":"Check if plink is available.\n"}],"source_definition_sha256":"f06d529cce97b6ad7c99dedb2b5ae87bc4c4db79d175419f07be5b4445615e77"},{"id":"3d8c25b5-7ff5-4c9d-b21f-85ebd06654a4","name":"Logoff System - Windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test performs a Windows system logoff as seen in [dcrat backdoor capabilities](https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor)\n","inputs":{},"dependencies":[],"source_definition_sha256":"7416878624be74eddaec49a0a9d9fd2b18349dc43cfd9f2d494d7997fea0dfcc"},{"id":"47d0b042-a918-40ab-8cf9-150ffe919027","name":"Restart System via `reboot` - FreeBSD/macOS/Linux","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test restarts a FreeBSD/macOS/Linux system via `reboot`.\n","inputs":{},"dependencies":[],"source_definition_sha256":"028fda0e7be8e98a54b5ad49300aef1d4dc31b188b29b20389bcb8b20592f5a8"},{"id":"4963a81e-a3ad-4f02-adda-812343b351de","name":"Shutdown System via `shutdown` - FreeBSD/macOS/Linux","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test shuts down a FreeBSD/macOS/Linux system using a halt.\n","inputs":{"timeout":{"description":"Time to shutdown (can be minutes or specific time)","type":"string","default":"now"}},"dependencies":[],"source_definition_sha256":"aab002b644a3277e904c7b919c7f98d1884341c5f378c0365ba46a39ef7b7017"},{"id":"5a282e50-86ff-438d-8cef-8ae01c9e62e1","name":"Reboot System via `poweroff` - FreeBSD","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test restarts a FreeBSD system using `poweroff`.\n","inputs":{},"dependencies":[],"source_definition_sha256":"5a4f1d49df85a0159cff137a934f4d21db14f7d787fb0bffc6b9b7115bad24fa"},{"id":"61303105-ff60-427b-999e-efb90b314e41","name":"Reboot System via `poweroff` - Linux","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test restarts a Linux system using `poweroff`.\n","inputs":{},"dependencies":[],"source_definition_sha256":"c06a6962ee4b6abcbfcdf18952f3ca534341e4e4f1e1b0405b60efbaf0460845"},{"id":"622cc1a0-45e7-428c-aed7-c96dd605fbe6","name":"ESXi - vim-cmd Used to Power Off VMs","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"Adversaries may power off VMs to facilitate the deployment of ransomware payloads.\n[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#power%20off%20vm)\n","inputs":{"vm_host":{"description":"Specify the host name or IP of the ESXi server.","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on the ESXi server.","type":"string","default":"root"},"vm_pass":{"description":"Specify the privileged user's password.","type":"string","default":"password"},"plink_file":{"description":"Path to Plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"}},"dependencies":[{"description":"Check if we have plink\n"}],"source_definition_sha256":"52a0f15977dfdbbb1f0e668c71a09302fc0a123324df5038ba87b8da529ff6ef"},{"id":"6326dbc4-444b-4c04-88f4-27e94d0327cb","name":"Restart System via `shutdown` - FreeBSD/macOS/Linux","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test restarts a FreeBSD/macOS/Linux system.\n","inputs":{"timeout":{"description":"Time to restart (can be minutes or specific time)","type":"string","default":"now"}},"dependencies":[],"source_definition_sha256":"5d84e8b4c353f6c49b5bf39ffdff1e6a8c898f37f8ad4b00edec1842d90768b2"},{"id":"73a90cd2-48a2-4ac5-8594-2af35fa909fa","name":"Shutdown System via `poweroff` - FreeBSD/Linux","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test shuts down a FreeBSD/Linux system using `poweroff`.\n","inputs":{},"dependencies":[],"source_definition_sha256":"8839840ce34eeafdb51a4a1f3b22bf432031d022ebe43ab38b00147195d7ba54"},{"id":"78f92e14-f1e9-4446-b3e9-f1b921f2459e","name":"Reboot System via `halt` - Linux","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test restarts a Linux system using `halt`.\n","inputs":{},"dependencies":[],"source_definition_sha256":"36e8613801468b87b16c9cc5b989d33be185d4d629ec862f4f6c94d2d10a4325"},{"id":"7b1cee42-320f-4890-b056-d65c8b884ba5","name":"Reboot System via `halt` - FreeBSD","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test restarts a FreeBSD system using `halt`.\n","inputs":{},"dependencies":[],"source_definition_sha256":"4f61d2e3be67b8f2d2c12953bea10abd201d9166a919c816dd9478214f3161bb"},{"id":"918f70ab-e1ef-49ff-bc57-b27021df84dd","name":"Shutdown System via `halt` - FreeBSD/Linux","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test shuts down a FreeBSD/Linux system using `halt`.\n","inputs":{},"dependencies":[],"source_definition_sha256":"d5c8a4917d2cced80ca7964f15041f3aee8a5b6d25200c380889eafa9e30fdf1"},{"id":"987c9b4d-a637-42db-b1cb-e9e242c3991b","name":"ESXi - Terminates VMs using pkill","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"In VMWARE ESXi, process names starting with vmx are associated with running VMs. An adversary can use the pkill command to kill all processes with a prefix vmx.\n[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)\n","inputs":{"vm_host":{"description":"Specify the host name of the ESXi Server","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on ESXi Server","type":"string","default":"root"},"vm_pass":{"description":"Specify the privilege user password on ESXi Server","type":"string","default":"pass"},"plink_file":{"description":"Path to plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"},"cli_script":{"description":"Path to text with commands","type":"path","default":"PathToAtomicsFolder\\T1529\\src\\esx_pkill.txt"}},"dependencies":[{"description":"Check if plink is available.\n"}],"source_definition_sha256":"ce4797ee0a7351bcdb0881caaabf195008585ef15be8ef72027d84cd88c1aaae"},{"id":"ad254fa8-45c0-403b-8c77-e00b3d3e7a64","name":"Shutdown System - Windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test shuts down a Windows system.\n","inputs":{"timeout":{"description":"Timeout period before shutdown (seconds)","type":"integer","default":1}},"dependencies":[],"source_definition_sha256":"3f99def86df3cb6759b36b0465f9f162259709ebf06d4124c050229a14a1288f"},{"id":"d2a1f4bc-a064-4223-8281-a086dce5423c","name":"Abuse of Linux Magic System Request Key for Reboot","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can forced to reboot.\n","inputs":{},"dependencies":[],"source_definition_sha256":"214f24d2fe822f21b5aebfb1888bbd0704ad94ee2bbb771aff005309810bc958"},{"id":"f4648f0d-bf78-483c-bafc-3ec99cd1c302","name":"Restart System - Windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml","description":"This test restarts a Windows system.\n","inputs":{"timeout":{"description":"Timeout period before restart (seconds)","type":"integer","default":1}},"dependencies":[],"source_definition_sha256":"954e8203801aeabc7a9bf83994784e8ec77ac2df11f645415037ec1567c873aa"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/","T1134":"/ttp-simulation/techniques/enterprise/T1134/","T1561.002":"/ttp-simulation/techniques/enterprise/T1561.002/","T1490":"/ttp-simulation/techniques/enterprise/T1490/","T1529":"/ttp-simulation/techniques/enterprise/T1529/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1529","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}