Loading interactive filters…

1200KM / simulation

T1529 System Shutdown/Reboot — Attack Simulation

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. reload). They may also include shutdown/reboot of a virtual machine via hypervisor / cloud…

Complete technique description

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. <code>reload</code>).[Microsoft Shutdown Oct 2017][alert_TA18_106A] They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.

Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.

Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.[CrowdStrike Blog][Unit42 Agrius 2023] Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.[SonicWall][NtRaiseHardError][NotMe-BSOD] In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via Access Token Manipulation).[Unit42 Agrius 2023]
In some cases, the system may not be able to boot again.

Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as Disk Structure Wipe or Inhibit System Recovery, to hasten the intended effects on system availability.[Talos Nyetya June 2017][Talos Olympic Destroyer 2018]

Official technique definition · Open in the interactive matrix

Detection telemetry and configuration

These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.

Command Execution · source-mapped

DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.

Providers and collection configuration

PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
Sysmon process events: Interpreter launch and parent context, not full script content.
Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: interpreter, command_line, actor_uid, session_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0064",
  "collector": "illustrative-lab-collector",
  "observation": {
    "interpreter": "/bin/sh",
    "command_line": "printf LAB_TELEMETRY_CHECK",
    "actor_uid": 1000,
    "session_id": "lab-session-1"
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

Host Status · source-mapped

DC0018 collection page — Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.

Providers and collection configuration

osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: asset_id, status, heartbeat_age_seconds, collector_healthy.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0018",
  "collector": "illustrative-lab-collector",
  "observation": {
    "asset_id": "lab-host-1",
    "status": "degraded",
    "heartbeat_age_seconds": 90,
    "collector_healthy": true
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

Process Creation · source-mapped

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Detection rules and analytic guidance

Open the dedicated detection workspace · Existing query engineering

DET0559 Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events

MITRE detection strategy

AN1538 Analytic 1538

Correlate process execution of shutdown/reboot commands (e.g., shutdown.exe, restart-computer) with host status change logs (Event IDs 1074, 6006) and absence of related administrative context (e.g., user not in Helpdesk group).

Platforms: Windows.

Host Status — WinEventLog:Security; channel EventCode=1074.
Process Creation — WinEventLog:Sysmon; channel EventCode=1.

AN1539 Analytic 1539

Detect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.

Platforms: Linux.

Command Execution — auditd:SYSCALL; channel execve=/sbin/shutdown or /sbin/reboot.
Host Status — linux:syslog; channel system is powering down.

AN1540 Analytic 1540

Identify use of 'shutdown', 'reboot', or 'osascript' system shutdown invocations within unified logs and track unexpected shutdown sequences initiated by GUI or script. Cross-reference with user activity or absence thereof.

Platforms: macOS.

Process Creation — macos:unifiedlog; channel shutdown -h now or reboot.
Host Status — macos:unifiedlog; channel System shutdown or reboot requested.

AN1541 Analytic 1541

Detect commands such as 'esxcli system shutdown' or 'vim-cmd vmsvc/power.shutdown' executed outside of maintenance windows or via unusual users. Reboot logs in hostd.log and shell logs should be correlated.

Platforms: ESXi.

Host Status — esxi:hostd; channel Powering off or restarting host.
Command Execution — esxi:shell; channel esxcli system shutdown or reboot invoked.

AN1542 Analytic 1542

Monitor CLI 'reload' commands issued without scheduled maintenance, and correlate to TACACS+/AAA logs for privilege validation.

Platforms: Network Devices.

Command Execution — networkdevice:syslog; channel reload command issued.
Host Status — networkdevice:syslog; channel System reboot scheduled or performed.

Source rule directory and observation requirements

8 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

System Shutdown/Reboot - Linux — test; product: linux; service: auditd.
Potential Abuse of Linux Magic System Request Key — experimental; product: linux; service: auditd; definition: Required auditd configuration: -w /proc/sysrq-trigger -p wa -k sysrq -w /proc/sys/kernel/sysrq -p wa -k sysrq .
ESXi VM Kill Via ESXCLI — test; category: process_creation; product: linux.
System Shutdown/Reboot - MacOs — test; product: macos; category: process_creation.
Cisco Denial of Service — test; product: cisco; service: aaa.
Silence.EDA Detection — test; product: windows; category: ps_script; definition: Requirements: Script Block Logging must be enabled.
Suspicious Execution of Shutdown — test; category: process_creation; product: windows.
Suspicious Execution of Shutdown to Log Out — test; category: process_creation; product: windows.

Before treating a rule as coverage

Read the actual condition and logsource; identify attacker-side, victim-side or third-party visibility.
Map native sensor fields, parse times and identities, then compile for the selected backend.
Replay a behavior-positive case, a normal control, an authorized look-alike and a missing-telemetry case.
Record matches and misses with rule version and source events. No match is inconclusive when required telemetry is absent.

Anomaly-based detection

No exact technique-specific Atlas model is present for T1529 in the selected source snapshot. The following is a design worksheet, not a newly validated model.

Anomaly engineering worksheet

Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.

Script and command execution: Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility.
Host state and inventory: Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion.
Endpoint activity: Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity.

Define an entity/peer group and feature; exclude the evaluation period from baseline training.
Use representative normal and maintenance activity. Do not invent a production threshold from a synthetic example.
Evaluate held-out behavior-positive and benign cases; measure false positives, misses and telemetry loss separately.
Keep abnormality separate from maliciousness. Correlate with the behavior-specific source evidence.

Anomaly Detection Atlas · Baseline, validation and blind spots

Attack tools and documented software

Remcos

Software observed in source procedures

These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.

27 source-documented software associations

S0140 Shamoon — malware.
Shamoon will reboot the infected system once the wiping functionality has been completed.[Unit 42 Shamoon3 2018][McAfee Shamoon December 2018]
Exact relationship: relationship--d2ff2c76-04ed-41c4-bd35-75f7cf823aee
S0332 Remcos — tool.
Remcos can shutdown and restart remote devices.[Fortinet Remcos Campaign NOV 2024]
Exact relationship: relationship--e87ba6d8-8228-45af-b235-54a0e0666a23
S0365 Olympic Destroyer — malware.
Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.[Talos Olympic Destroyer 2018][US District Court Indictment GRU Unit 74455 October 2020]
Exact relationship: relationship--4932951a-b313-4024-bbad-434de3b747c5
S0368 NotPetya — malware.
NotPetya will reboot the system one hour after infection.[Talos Nyetya June 2017][US District Court Indictment GRU Unit 74455 October 2020]
Exact relationship: relationship--aa158d48-a9f5-49bb-8f15-166705f29b36
S0372 LockerGoga — malware.
LockerGoga has been observed shutting down infected systems.[Wired Lockergoga 2019]
Exact relationship: relationship--3c7bb2a4-eede-4dae-ac41-03782729a961
S0449 Maze — malware.
Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.[Sophos Maze VM September 2020]
Exact relationship: relationship--62c1a647-4a39-45b1-8d68-99b19ec12a78
S0582 LookBack — malware.
LookBack can shutdown and reboot the victim machine.[Proofpoint LookBack Malware Aug 2019]
Exact relationship: relationship--66d53000-135b-448d-988a-3ff5d53b2c5b
S0607 KillDisk — malware.
KillDisk attempts to reboot the machine by terminating specific processes.[Trend Micro KillDisk 2]
Exact relationship: relationship--9d6c5d09-94b9-4453-a26d-8b3ac79cfe7f
S0689 WhisperGate — malware.
WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.[Cisco Ukraine Wipers January 2022]
Exact relationship: relationship--97453382-d064-4705-9a63-b21356d4bfce
S0697 HermeticWiper — malware.
HermeticWiper can initiate a system shutdown.[SentinelOne Hermetic Wiper February 2022][Qualys Hermetic Wiper March 2022]
Exact relationship: relationship--f86b3fe5-c004-4fed-aaac-cf7d68b8d315
S1033 DCSrv — malware.
DCSrv has a function to sleep for two hours before rebooting the system.[Checkpoint MosesStaff Nov 2021]
Exact relationship: relationship--0ef5c336-794e-4700-b40e-c78eed74d353
S1053 AvosLocker — malware.
AvosLocker’s Linux variant has terminated ESXi virtual machines.[Trend Micro AvosLocker Apr 2022]
Exact relationship: relationship--fc89b538-26d8-434a-954f-e7d0b384b506
S1070 Black Basta — malware.
Black Basta has used `ShellExecuteA` to shut down and restart the victim system.[Trend Micro Black Basta May 2022]
Exact relationship: relationship--d82f1883-45a6-4b1e-ab7c-e5a3342a3cb9
S1111 DarkGate — malware.
DarkGate has used the `shutdown`command to shut down and/or restart the victim system.[Rapid7 BlackBasta 2024]
Exact relationship: relationship--d82bfd25-1dab-45a6-ad66-1eeb6190a63a
S1125 AcidRain — malware.
AcidRain reboots the target system once the various wiping processes are complete.[AcidRain JAGS 2022]
Exact relationship: relationship--098c0f13-e56f-43ff-8fee-0cce9d771092
S1133 Apostle — malware.
Apostle reboots the victim machine following wiping and related activity.[SentinelOne Agrius 2021]
Exact relationship: relationship--6a8c7cab-bdf7-43dc-960b-84f47767f2df
S1135 MultiLayer Wiper — malware.
MultiLayer Wiper reboots the infected system following wiping and related tasks to prevent system recovery.[Unit42 Agrius 2023]
Exact relationship: relationship--20d59bcb-04cd-4581-a18f-4f77dd96027c
S1136 BFG Agonizer — malware.
BFG Agonizer uses elevated privileges to call <code>NtRaiseHardError</code> to induce a "blue screen of death" on infected systems, causing a system crash. Once shut down, the system is no longer bootable.[Unit42 Agrius 2023]
Exact relationship: relationship--17b73eb6-f4a6-49d4-8f72-18796cf7d553
S1149 CHIMNEYSWEEP — malware.
CHIMNEYSWEEP can reboot or shutdown the targeted system or logoff the current user.[Mandiant ROADSWEEP August 2022]
Exact relationship: relationship--b153b867-6888-4071-bf34-d40305ca4150
S1160 Latrodectus — malware.
Latrodectus has the ability to restart compromised hosts.[Elastic Latrodectus May 2024]
Exact relationship: relationship--aba4a71f-ddee-428b-a454-9842fd8750fd
S1167 AcidPour — malware.
AcidPour includes functionality to reboot the victim system following wiping actions, similar to AcidRain.[SentinelOne AcidPour 2024]
Exact relationship: relationship--30c9b855-cb8e-43ab-8f4c-ffef015789d6
S1178 ShrinkLocker — malware.
ShrinkLocker can restart the victim system if it encounters an error during execution, and will forcibly shutdown the system following encryption to lock out victim users.[Kaspersky ShrinkLocker 2024]
Exact relationship: relationship--a6bb7182-2459-406d-89c1-51b20f1a88f7
S1207 XLoader — malware.
XLoader can initiate a system reboot or shutdown.[Google XLoader 2017]
Exact relationship: relationship--a506c8b0-572d-470f-b90b-146a81385d13
S1242 Qilin — malware.
Qilin can initiate a reboot of the backup server to hinder recovery.[Picus Qilin MAR 2025]
Exact relationship: relationship--1caaad2f-7a84-4e32-8134-edac0c4fcc72
S9038 DynoWiper — malware.
DynoWiper has used the Microsoft Windows native `ExitWindowsEx()` function to log off the interactive user and shutdown the system.[CERT Polska]
Exact relationship: relationship--13ff8433-97c7-40c3-a082-812453731bf2
S9042 CanisterWorm — malware.
CanisterWorm has forced the target system to reboot after file deletion.[Aikido CanisterWorm MAR 2026]
Exact relationship: relationship--394fe21a-c7a6-4571-abf5-03377b934634
S9051 The Gentlemen Ransomware — malware.
The Gentlemen Ransomware has conducted clean shutdowns of running VMs in ESXI environments using `vim-cmd vmsvc/power.off <vmid> > /dev/null 2>&1`. The Gentlemen Ransomware has also forcibly terminated running VM processes using `esxcli vm process kill --type=force --world-id=<world_id> > /dev/null 2>&1`.[CheckPointResearch_TheGentlemen_April2026]
Exact relationship: relationship--5978688d-f172-4af5-bfc6-f62789492766

Simulation design and documented procedures

Atomic evidence: 16 compatible documented candidates. Live lab status: not run for these imported procedures.

Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.

ESXi - Avoslocker enumerates VMs and forcefully kills VMs

Avoslocker malware has inbuilt functionality to enumerate the VM instances and uses the esxcli command to forcefully power off them. Reference

Pinned Atomic procedure · 189f7d6e-9442-4160-9bc3-5e4104d93ece · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

vm_host: Specify the host name of the ESXi Server (type string; source default atomic.local)
vm_user: Specify the privilege user account on ESXi Server (type string; source default root)
vm_pass: Specify the privilege user password on ESXi Server (type string; source default pass)
plink_file: Path to plink (type path; source default PathToAtomicsFolder\..\ExternalPayloads\plink.exe)
cli_script: Path to text with commands (type path; source default PathToAtomicsFolder\T1529\src\esx_avoslocker_kill_vm.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

Check if plink is available.

Logoff System - Windows

This test performs a Windows system logoff as seen in dcrat backdoor capabilities

Pinned Atomic procedure · 3d8c25b5-7ff5-4c9d-b21f-85ebd06654a4 · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Restart System via `reboot` - FreeBSD/macOS/Linux

This test restarts a FreeBSD/macOS/Linux system via `reboot`.

Pinned Atomic procedure · 47d0b042-a918-40ab-8cf9-150ffe919027 · linux, macos · sh.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Shutdown System via `shutdown` - FreeBSD/macOS/Linux

This test shuts down a FreeBSD/macOS/Linux system using a halt.

Pinned Atomic procedure · 4963a81e-a3ad-4f02-adda-812343b351de · linux, macos · sh.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

timeout: Time to shutdown (can be minutes or specific time) (type string; source default now)

Reboot System via `poweroff` - FreeBSD

This test restarts a FreeBSD system using `poweroff`.

Pinned Atomic procedure · 5a282e50-86ff-438d-8cef-8ae01c9e62e1 · linux · sh.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Reboot System via `poweroff` - Linux

This test restarts a Linux system using `poweroff`.

Pinned Atomic procedure · 61303105-ff60-427b-999e-efb90b314e41 · linux · bash.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

ESXi - vim-cmd Used to Power Off VMs

Adversaries may power off VMs to facilitate the deployment of ransomware payloads. Reference

Pinned Atomic procedure · 622cc1a0-45e7-428c-aed7-c96dd605fbe6 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

vm_host: Specify the host name or IP of the ESXi server. (type string; source default atomic.local)
vm_user: Specify the privilege user account on the ESXi server. (type string; source default root)
vm_pass: Specify the privileged user's password. (type string; source default password)
plink_file: Path to Plink (type path; source default PathToAtomicsFolder\..\ExternalPayloads\plink.exe)

1 prerequisite definitions:

Check if we have plink

Restart System via `shutdown` - FreeBSD/macOS/Linux

This test restarts a FreeBSD/macOS/Linux system.

Pinned Atomic procedure · 6326dbc4-444b-4c04-88f4-27e94d0327cb · linux, macos · sh.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

timeout: Time to restart (can be minutes or specific time) (type string; source default now)

Shutdown System via `poweroff` - FreeBSD/Linux

This test shuts down a FreeBSD/Linux system using `poweroff`.

Pinned Atomic procedure · 73a90cd2-48a2-4ac5-8594-2af35fa909fa · linux · sh.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Reboot System via `halt` - Linux

This test restarts a Linux system using `halt`.

Pinned Atomic procedure · 78f92e14-f1e9-4446-b3e9-f1b921f2459e · linux · bash.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Reboot System via `halt` - FreeBSD

This test restarts a FreeBSD system using `halt`.

Pinned Atomic procedure · 7b1cee42-320f-4890-b056-d65c8b884ba5 · linux · sh.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Shutdown System via `halt` - FreeBSD/Linux

This test shuts down a FreeBSD/Linux system using `halt`.

Pinned Atomic procedure · 918f70ab-e1ef-49ff-bc57-b27021df84dd · linux · sh.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

ESXi - Terminates VMs using pkill

In VMWARE ESXi, process names starting with vmx are associated with running VMs. An adversary can use the pkill command to kill all processes with a prefix vmx. Reference

Pinned Atomic procedure · 987c9b4d-a637-42db-b1cb-e9e242c3991b · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

vm_host: Specify the host name of the ESXi Server (type string; source default atomic.local)
vm_user: Specify the privilege user account on ESXi Server (type string; source default root)
vm_pass: Specify the privilege user password on ESXi Server (type string; source default pass)
plink_file: Path to plink (type path; source default PathToAtomicsFolder\..\ExternalPayloads\plink.exe)
cli_script: Path to text with commands (type path; source default PathToAtomicsFolder\T1529\src\esx_pkill.txt)

1 prerequisite definitions:

Check if plink is available.

Shutdown System - Windows

This test shuts down a Windows system.

Pinned Atomic procedure · ad254fa8-45c0-403b-8c77-e00b3d3e7a64 · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

timeout: Timeout period before shutdown (seconds) (type integer; source default 1)

Abuse of Linux Magic System Request Key for Reboot

adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can forced to reboot.

Pinned Atomic procedure · d2a1f4bc-a064-4223-8281-a086dce5423c · linux · bash.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Restart System - Windows

This test restarts a Windows system.

Pinned Atomic procedure · f4648f0d-bf78-483c-bafc-3ec99cd1c302 · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

timeout: Timeout period before restart (seconds) (type integer; source default 1)

Technique-specific experiment contract

Choose one procedure implementing T1529 System Shutdown/Reboot; identify the observable behavior in the source definition, not just its tactic.
Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
Enable the collection sources above and verify a benign baseline reaches the detector.
Run only the approved isolated scenario; capture native events and an independent behavior observable.
Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.

Synthetic logs and offline contract check

Download synthetic collection fixture (JSON) · Download the complete engineering workbook

This fixture exercises the listed collection fields. It does not reproduce System Shutdown/Reboot, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.

Not run in this browser. No network scan or attack command is executed by this control.

Validation status and remaining work

Source identity: Joined by exact technique/object IDs against hash-pinned sources.
Collection fixture: Available for offline schema exercises; not attack emulation.
Native telemetry / backend / real attack: Not validated for these imported procedures. Source fidelity and page tests cannot establish sensor or detector effectiveness.

All-page audit and evidence inventory · This page’s machine-readable workbook

Sources and evidence boundaries

Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.

Connected ecosystem references

Detection and collection

T1529 detection workspace

Remcos · S0332

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.

T1529 System Shutdown/Reboot — Attack Simulation

Complete technique description

Detection telemetry and configuration

Providers and collection configuration

Illustrative collection event

Providers and collection configuration

Illustrative collection event

Providers and collection configuration

Illustrative collection event

Detection rules and analytic guidance

AN1538 Analytic 1538

AN1539 Analytic 1539

AN1540 Analytic 1540

AN1541 Analytic 1541

AN1542 Analytic 1542

Before treating a rule as coverage

Anomaly-based detection

Anomaly engineering worksheet

Attack tools and documented software

Remcos

Software observed in source procedures

Simulation design and documented procedures

Source-defined inputs

Source-defined inputs

Source-defined inputs

Source-defined inputs

Source-defined inputs

Source-defined inputs

Source-defined inputs

Technique-specific experiment contract

Synthetic logs and offline contract check

Validation status and remaining work

Sources and evidence boundaries

Connected ecosystem references

Linked tags

Detection and collection

Related attack-tool pages

Threat actor context

Existing research