Applied Cybernetics Group
T1529 System Shutdown/Reboot
- Technique
T1529- Tactics
- Impact
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 8
- Elastic, Splunk
- 11
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1529
MITRE description
Adversaries may shut down/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. <code>reload</code>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023) In some cases, the system may not be able to boot again. Adversaries may attempt to shut down/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-22Group-IB: Inside SiriusQT: A Seriously Skilled RAT
Detection coverage
SigmaHQ community rules
- System Shutdown/Reboot - Linux (core)
- Potential Abuse of Linux Magic System Request Key (core)
- ESXi VM Kill Via ESXCLI (core)
- System Shutdown/Reboot - MacOs (core)
- Cisco Denial of Service (core)
- Silence.EDA Detection (core)
- Suspicious Execution of Shutdown (core)
- Suspicious Execution of Shutdown to Log Out (core)
Elastic and Splunk rules
- Azure Kubernetes Services (AKS) Kubernetes Pods Deleted (elastic)
- Azure Resource Group Deleted by Unusual Principal (elastic)
- ESXi Virtual Machine Powered Off (elastic)
- ESXi Bulk VM Termination (splunk)
- Microsoft Intune Manual Device Management (splunk)
- Linux Magic SysRq Key Abuse (splunk)
- Linux System Reboot Via System Request Key (splunk)
- Windows Common Abused Cmd Shell Risk Behavior (splunk)
- Windows System LogOff Commandline (splunk)
- Windows System Reboot CommandLine (splunk)
- Windows System Shutdown CommandLine (splunk)