T1529 System Shutdown/Reboot — Detection Rules

Source-backed rule directory

• System Shutdown/Reboot - Linux · test · informational · {"product":"linux","service":"auditd"}
• Potential Abuse of Linux Magic System Request Key · experimental · medium · {"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-w /proc/sysrq-trigger -p wa -k sysrq\n-w /proc/sys/kernel/sysrq -p wa -k sysrq\n"}
• ESXi VM Kill Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
• System Shutdown/Reboot - MacOs · test · informational · {"product":"macos","category":"process_creation"}
• Cisco Denial of Service · test · medium · {"product":"cisco","service":"aaa"}
• Silence.EDA Detection · test · critical · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Suspicious Execution of Shutdown · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Execution of Shutdown to Log Out · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0559 Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events

AN1538 Analytic 1538

Correlate process execution of shutdown/reboot commands (e.g., shutdown.exe, restart-computer) with host status change logs (Event IDs 1074, 6006) and absence of related administrative context (e.g., user not in Helpdesk group).

AN1539 Analytic 1539

Detect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.

AN1540 Analytic 1540

Identify use of 'shutdown', 'reboot', or 'osascript' system shutdown invocations within unified logs and track unexpected shutdown sequences initiated by GUI or script. Cross-reference with user activity or absence thereof.

AN1541 Analytic 1541

Detect commands such as 'esxcli system shutdown' or 'vim-cmd vmsvc/power.shutdown' executed outside of maintenance windows or via unusual users. Reboot logs in hostd.log and shell logs should be correlated.

AN1542 Analytic 1542

Monitor CLI 'reload' commands issued without scheduled maintenance, and correlate to TACACS+/AAA logs for privilege validation.