T1529 — System Shutdown/Reboot

Tactic: Impact · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote…

Sigma detection rules (5)

T1529 System Shutdown/Reboot

title: T1529 System Shutdown/Reboot
id: 9fda46ac-cf71-4377-995e-888ad6c51312
description: 'Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1529
author: Shahrukh Khan
date: 2026-03-01
license: MIT
tags:
  - attack.impact
  - attack.t1529

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\shutdown.exe'
    CommandLine|contains:
      - '/s'
      - '/r'

  selection_forced:
    CommandLine|contains: '/f'

  condition: selection and selection_forced

falsepositives:
  - Routine IT-initiated reboots/shutdowns for patching or maintenance; scope to unexpected hosts or off-hours activity.

level: medium

T1529 System Shutdown/Reboot

title: T1529 System Shutdown/Reboot
id: 6b0147fe-cc0b-43a3-a1f8-475f0836d447
description: 'Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLineMatch, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1529
author: Shahrukh Khan
date: 2026-06-07
license: MIT
tags:
  - attack.impact
  - attack.t1529

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/shutdown'
      - '/reboot'
      - '/halt'
      - '/poweroff'

  condition: selection

falsepositives:
  - Routine, change-managed reboots/shutdowns for patching; scope UserContext to accounts outside the approved maintenance window process.

level: medium

T1529 System Shutdown/Reboot

title: T1529 System Shutdown/Reboot
id: ecead070-0abb-4134-95fa-76c85ecaac9c
description: 'Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchMechanism, LogGranularity.'
references:
  - https://attack.mitre.org/techniques/T1529
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.impact
  - attack.t1529

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/shutdown'
      - '/reboot'
      - '/halt'
  selection_parent:
    ParentImage|endswith:
      - '/bash'
      - '/zsh'
      - '/osascript'
      - '/python3'
  condition: selection and selection_parent

falsepositives:
  - Users and MDM maintenance scripts legitimately trigger shutdown and reboot as part of routine patch cycles, so this should be scoped to unexpected invocations outside a scheduled maintenance window or preceded by destructive activity such as file deletion.

level: medium

T1529 System Shutdown/Reboot

title: T1529 System Shutdown/Reboot
id: 51faa7f9-c8d9-4b39-acd6-c50482e295d3
description: 'Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events. (Data Component: Command Execution; baseline tier: fallback.) Tune using: PrivilegeLevel, ChangeTicketCorrelation.'
references:
  - https://attack.mitre.org/techniques/T1529
author: Shahrukh Khan
date: 2026-02-11
license: MIT
tags:
  - attack.impact
  - attack.t1529

logsource:
  category: process_creation
  product: networkdevice
  service: syslog

detection:
  selection_reload:
    CommandLine|contains:
      - 'reload'
      - 'reload in'
  selection_msg:
    Message|contains: '%SYS-5-RELOAD'
  condition: 1 of selection_*

falsepositives:
  - A planned maintenance reboot executed outside the expected automated change ticket correlation window will also trigger this rule.

level: high

T1529 System Shutdown/Reboot

title: T1529 System Shutdown/Reboot
id: 8eb41bb6-705d-4376-acda-6ae6b4f8184e
description: 'Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccountRole, MaintenanceWindow.'
references:
  - https://attack.mitre.org/techniques/T1529
author: Shahrukh Khan
date: 2026-06-01
license: MIT
tags:
  - attack.impact
  - attack.t1529

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli system shutdown'
      - 'esxcli system reboot'
      - 'vim-cmd hostsvc/maintenance_mode_enter'

  condition: selection

falsepositives:
  - Scheduled maintenance windows or firmware update workflows that legitimately reboot or place the host in maintenance mode; AccountRole should be checked to confirm the initiating account has authorized administrative privileges for the operation.

level: high

Explore