T1529 System Shutdown/Reboot
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008)…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Silence.EDA Detectioncriticaltest · windows
- Cisco Denial of Servicemediumtest · cisco
- ESXi VM Kill Via ESXCLImediumtest · linux
- Suspicious Execution of Shutdownmediumtest · windows
- Suspicious Execution of Shutdown to Log Outmediumtest · windows
- Potential Abuse of Linux Magic System Request Keymediumexperimental · linux
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.