T0816 Device Restart/Shutdown — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0801 Detection of Device Restart/Shutdown

AN1933 Analytic 1933

Real-time monitoring identifies an Industrial Control System (ICS) protocol restart/reset command directed at a field device from a source not in the approved engineering workstation list, particularly where multiple devices receive restart commands within a short window. Documented precedent: Industroyer exploited CVE-2015-5374 via a crafted 18-byte User Datagram Protocol (UDP) packet to port 50000 on Siemens SIPROTEC relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2157 Analytic 2157

Real-time monitoring identifies an Industrial Control System (ICS) Linux engineering tool issuing device restart commands outside a scheduled maintenance window, from a User Identifier (UID) not in the approved engineer list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2187 Analytic 2187

Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to power Management Information Base (MIB) restart Object Identifiers (OIDs) or Command Line Interface (CLI) reload commands from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2260 Analytic 2260

Real-time monitoring identifies Industrial Control System (ICS) vendor engineering software initiating a device restart command from a Windows host outside a scheduled maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.