System Shutdown/Reboot

What is System Shutdown/Reboot?

“System Shutdown/Reboot is documented as technique T1529 in MITRE ATT&CK® v19.1 under the Impact tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify System Shutdown/Reboot activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for unauthorized shutdown and reboot commands executed via command line or scripts, particularly those targeting multiple systems simultaneously or using force flags that override user sessions.

2. 2

   Alert on shutdown events initiated from remote sessions or by processes that do not normally perform system shutdown operations, correlating with prior suspicious activity to assess whether it is part of an attack chain.

3. 3

   Detect scheduled shutdown tasks created by attackers to trigger system shutdowns at specific times, which may be used to time reboots to coincide with attack phases or to cover tracks after completing attack objectives.

4. 4

   Monitor for shutdown events on critical infrastructure including domain controllers, core servers, and operational technology systems, as these may have disproportionate impact on business operations.

5. 5

   Correlate shutdown events with other attack indicators including credential theft, lateral movement, and destructive payload execution to determine whether shutdowns are being used as part of a coordinated impact operation.

Example Alerts

These realistic alert examples show what System Shutdown/Reboot looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect System Shutdown/Reboot?

Detection centers on SIEM, XDR telemetry for the impact phase of the attack. Monitor for unauthorized shutdown and reboot commands executed via command line or scripts, particularly those targeting multiple systems simultaneously or using force flags that override user sessions. Alert on shutdown events initiated from remote sessions or by processes that do not normally perform system shutdown operations, correlating with prior suspicious activity to assess whether it is part of an attack chain.

What does a System Shutdown/Reboot alert look like?

A representative SIEM detection is "Mass System Shutdown Command Executed" (critical severity): WMI used to execute shutdown /s /f /t 0 on 156 systems simultaneously across all network segments. The command was issued by a compromised domain admin account from an external IP address using PowerShell remoting. The simultaneous shutdown of 156 systems including all file servers, application servers, and workstations represents a significant business disruption event consistent with a coordinated destructive attack.

Which tools detect System Shutdown/Reboot, and how can I practice?

System Shutdown/Reboot (T1529) is best surfaced with SIEM, XDR telemetry, which exposes the impact signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.