System Shutdown/Reboot

let SuspiciousParents = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "msiexec.exe"]);
// Branch 1: Windows shutdown.exe
let WindowsShutdown = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "shutdown.exe"
| where ProcessCommandLine has_any ("/s", "/r", "-s", "-r")
| extend ImmediateShutdown = ProcessCommandLine has "/t 0" or ProcessCommandLine has "-t 0"
| extend ForcedShutdown = ProcessCommandLine has "/f" or ProcessCommandLine has "-f"
| extend RemoteShutdown = ProcessCommandLine has "/m"
| extend SuspiciousParent = InitiatingProcessFileName in~ (SuspiciousParents)
| extend RiskScore = toint(ImmediateShutdown) + toint(ForcedShutdown) + toint(SuspiciousParent) * 2
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         ImmediateShutdown, ForcedShutdown, RemoteShutdown, SuspiciousParent, RiskScore,
         DetectionBranch="WindowsShutdownExe";
// Branch 2: PowerShell Windows API abuse (ExitWindowsEx, NtRaiseHardError)
let PowerShellAPIAbuse = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (
    "ExitWindowsEx", "InitiateSystemShutdown", "InitializeSystemShutdownExW",
    "NtRaiseHardError", "ZwRaiseHardError",
    "EWX_SHUTDOWN", "EWX_REBOOT", "EWX_POWEROFF",
    "OptionShutdownSystem", "SeShutdownPrivilege"
  )
| extend ImmediateShutdown = true
| extend ForcedShutdown = true
| extend RemoteShutdown = false
| extend SuspiciousParent = true
| extend RiskScore = 4
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         ImmediateShutdown, ForcedShutdown, RemoteShutdown, SuspiciousParent, RiskScore,
         DetectionBranch="PowerShellAPIAbuse";
// Branch 3: Linux/macOS shutdown utilities
let LinuxMacShutdown = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    (FileName in~ ("shutdown", "reboot", "halt", "poweroff"))
    or (FileName =~ "systemctl" and ProcessCommandLine has_any ("poweroff", "reboot", "halt", "shutdown"))
    or (FileName =~ "init" and ProcessCommandLine matches regex @"\s[06]$")
  )
| where DeviceOSPlatform in~ ("Linux", "macOS")
| extend ImmediateShutdown = ProcessCommandLine has_any ("-t 0", "now", "+0")
| extend ForcedShutdown = ProcessCommandLine has_any ("-f", "--force")
| extend RemoteShutdown = false
| extend SuspiciousParent = InitiatingProcessFileName in~ (SuspiciousParents)
| extend RiskScore = toint(ImmediateShutdown) + toint(ForcedShutdown) + toint(SuspiciousParent) * 2
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         ImmediateShutdown, ForcedShutdown, RemoteShutdown, SuspiciousParent, RiskScore,
         DetectionBranch="LinuxMacShutdown";
WindowsShutdown
| union PowerShellAPIAbuse
| union LinuxMacShutdown
| where RiskScore >= 1
| sort by RiskScore desc, Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (Image="*\\shutdown.exe" AND (CommandLine="*/s *" OR CommandLine="*/r *" OR CommandLine="*-s *" OR CommandLine="*-r *" OR CommandLine="*/s" OR CommandLine="*/r"))
  OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
      AND (CommandLine="*ExitWindowsEx*" OR CommandLine="*InitiateSystemShutdown*" OR CommandLine="*NtRaiseHardError*"
           OR CommandLine="*ZwRaiseHardError*" OR CommandLine="*EWX_SHUTDOWN*" OR CommandLine="*EWX_REBOOT*"
           OR CommandLine="*OptionShutdownSystem*" OR CommandLine="*SeShutdownPrivilege*"))
  OR (match(Image, "/(shutdown|reboot|halt|poweroff)$") AND NOT match(Image, "\.exe$"))
  OR (Image="*/systemctl" AND (CommandLine="*poweroff*" OR CommandLine="*reboot*" OR CommandLine="*halt*"))
)
| eval IsWindowsShutdownExe=if(match(Image, "\\\\shutdown\.exe$"), 1, 0)
| eval IsPowerShellAPI=if(match(lower(CommandLine), "(exitwindowsex|initiatesystemshutdown|initializesystemshutdownexw|ntraiseharderror|zwraiseharderror|ewx_shutdown|ewx_reboot|ewx_poweroff|optionshutdownsystem|seshutdownprivilege)"), 1, 0)
| eval IsLinuxMacShutdown=if(match(Image, "/(shutdown|reboot|halt|poweroff|systemctl)$") AND NOT match(Image, "\.exe"), 1, 0)
| eval ImmediateShutdown=if(match(CommandLine, "(/t\s*0|-t\s*0|\bnow\b|\+0)"), 1, 0)
| eval ForcedShutdown=if(match(CommandLine, "(/f[\s"]|-f[\s"]|--force)"), 1, 0)
| eval RemoteShutdown=if(match(CommandLine, "(/m\s|/m\\\\)"), 1, 0)
| eval SuspiciousParent=if(match(ParentImage, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|msiexec\.exe)"), 1, 0)
| eval RiskScore=IsWindowsShutdownExe + (IsPowerShellAPI * 4) + ImmediateShutdown + ForcedShutdown + (SuspiciousParent * 2) + RemoteShutdown
| where RiskScore >= 1
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        IsWindowsShutdownExe, IsPowerShellAPI, IsLinuxMacShutdown,
        ImmediateShutdown, ForcedShutdown, RemoteShutdown, SuspiciousParent, RiskScore
| sort - RiskScore - _time

sequence by host.name with maxspan=5m
[
  any where event.category == "process" and event.type == "start" and
  (
    (process.name : "shutdown.exe" and process.args : ("/s", "/r", "-s", "-r"))
    or
    (process.name : ("powershell.exe", "pwsh.exe") and
     process.args : ("ExitWindowsEx", "InitiateSystemShutdown", "InitiateSystemShutdownExW",
                     "NtRaiseHardError", "ZwRaiseHardError",
                     "EWX_SHUTDOWN", "EWX_REBOOT", "EWX_POWEROFF",
                     "OptionShutdownSystem", "SeShutdownPrivilege"))
    or
    (process.name : ("shutdown", "reboot", "halt", "poweroff") and
     not process.name : "*.exe" and
     host.os.type : ("linux", "macos"))
    or
    (process.name : "systemctl" and
     process.args : ("poweroff", "reboot", "halt", "shutdown") and
     host.os.type : ("linux", "macos"))
  )
]

// Standalone alert for high-risk single events
process where event.type == "start" and
(
  (
    process.name : "shutdown.exe" and
    process.args : ("/s", "/r", "-s", "-r") and
    (
      process.args : ("/t", "-t") or
      process.args : ("/f", "-f") or
      process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                              "cscript.exe", "mshta.exe", "regsvr32.exe",
                              "rundll32.exe", "msiexec.exe")
    )
  )
  or
  (
    process.name : ("powershell.exe", "pwsh.exe") and
    process.command_line : ("*ExitWindowsEx*", "*InitiateSystemShutdown*",
                            "*NtRaiseHardError*", "*ZwRaiseHardError*",
                            "*EWX_SHUTDOWN*", "*EWX_REBOOT*", "*OptionShutdownSystem*")
  )
)

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "Parent Process Name" AS parent_process,
  CATEGORYNAME(category) AS event_category,
  LOGSOURCETYPENAME(logsourcetypeid) AS log_source_type,
  CASE
    WHEN LOWER("Process Name") LIKE '%shutdown.exe%' THEN 1
    ELSE 0
  END +
  CASE
    WHEN LOWER("Command") LIKE '%exitwindowsex%'
      OR LOWER("Command") LIKE '%initiatesystemshutdown%'
      OR LOWER("Command") LIKE '%ntraiseharderror%'
      OR LOWER("Command") LIKE '%zwraiseharderror%'
      OR LOWER("Command") LIKE '%ewx_shutdown%'
      OR LOWER("Command") LIKE '%ewx_reboot%'
      OR LOWER("Command") LIKE '%optionshutdownsystem%' THEN 4
    ELSE 0
  END +
  CASE
    WHEN LOWER("Command") LIKE '%/t 0%' OR LOWER("Command") LIKE '%-t 0%'
      OR LOWER("Command") LIKE '%now%' THEN 1
    ELSE 0
  END +
  CASE
    WHEN LOWER("Command") LIKE '%/f%' OR LOWER("Command") LIKE '%-f %'
      OR LOWER("Command") LIKE '%--force%' THEN 1
    ELSE 0
  END +
  CASE
    WHEN LOWER("Parent Process Name") LIKE '%cmd.exe%'
      OR LOWER("Parent Process Name") LIKE '%powershell.exe%'
      OR LOWER("Parent Process Name") LIKE '%pwsh.exe%'
      OR LOWER("Parent Process Name") LIKE '%wscript.exe%'
      OR LOWER("Parent Process Name") LIKE '%cscript.exe%'
      OR LOWER("Parent Process Name") LIKE '%mshta.exe%'
      OR LOWER("Parent Process Name") LIKE '%regsvr32.exe%'
      OR LOWER("Parent Process Name") LIKE '%rundll32.exe%'
      OR LOWER("Parent Process Name") LIKE '%msiexec.exe%' THEN 2
    ELSE 0
  END AS risk_score
FROM events
WHERE
  LOGSOURCETYPEID IN (
    SELECT id FROM logsourcetypes WHERE name LIKE '%Sysmon%'
       OR name LIKE '%Windows%Security%'
       OR name LIKE '%Audit%'
  )
  AND starttime > (NOW() - 86400000)
  AND (
    (
      LOWER("Process Name") LIKE '%shutdown.exe%'
      AND (
        LOWER("Command") LIKE '%/s%' OR LOWER("Command") LIKE '%/r%'
        OR LOWER("Command") LIKE '%-s %' OR LOWER("Command") LIKE '%-r %'
      )
    )
    OR (
      (LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%pwsh.exe%')
      AND (
        LOWER("Command") LIKE '%exitwindowsex%'
        OR LOWER("Command") LIKE '%initiatesystemshutdown%'
        OR LOWER("Command") LIKE '%ntraiseharderror%'
        OR LOWER("Command") LIKE '%zwraiseharderror%'
        OR LOWER("Command") LIKE '%ewx_shutdown%'
        OR LOWER("Command") LIKE '%ewx_reboot%'
        OR LOWER("Command") LIKE '%optionshutdownsystem%'
        OR LOWER("Command") LIKE '%seshutdownprivilege%'
      )
    )
    OR (
      (
        LOWER("Process Name") LIKE '%/shutdown'
        OR LOWER("Process Name") LIKE '%/reboot'
        OR LOWER("Process Name") LIKE '%/halt'
        OR LOWER("Process Name") LIKE '%/poweroff'
      )
      AND LOWER("Process Name") NOT LIKE '%.exe'
    )
    OR (
      LOWER("Process Name") LIKE '%systemctl%'
      AND (
        LOWER("Command") LIKE '%poweroff%'
        OR LOWER("Command") LIKE '%reboot%'
        OR LOWER("Command") LIKE '%halt%'
      )
    )
  )
HAVING risk_score >= 1
ORDER BY risk_score DESC, event_time DESC

(_sourceCategory="os/windows/sysmon" OR _sourceCategory="os/linux/syslog" OR _sourceCategory="os/macos/audit")
| where EventID = 1 OR EventID = "1" OR _sourceCategory matches "*linux*" OR _sourceCategory matches "*macos*"
| parse field=CommandLine "*" as cmd_line nodrop
| parse field=Image "*" as image_path nodrop
| parse field=ParentImage "*" as parent_image nodrop
| where (
    (image_path matches "*\\shutdown.exe" and (
      cmd_line matches "*/s *" or cmd_line matches "*/r *" or
      cmd_line matches "*-s *" or cmd_line matches "*-r *" or
      cmd_line = "*/s" or cmd_line = "*/r"
    ))
    or (
      (image_path matches "*\\powershell.exe" or image_path matches "*\\pwsh.exe") and (
        cmd_line matches "*ExitWindowsEx*" or cmd_line matches "*InitiateSystemShutdown*" or
        cmd_line matches "*NtRaiseHardError*" or cmd_line matches "*ZwRaiseHardError*" or
        cmd_line matches "*EWX_SHUTDOWN*" or cmd_line matches "*EWX_REBOOT*" or
        cmd_line matches "*EWX_POWEROFF*" or cmd_line matches "*OptionShutdownSystem*" or
        cmd_line matches "*SeShutdownPrivilege*"
      )
    )
    or (
      (image_path matches "*/shutdown" or image_path matches "*/reboot" or
       image_path matches "*/halt" or image_path matches "*/poweroff")
      and not image_path matches "*.exe"
    )
    or (
      image_path matches "*/systemctl" and (
        cmd_line matches "*poweroff*" or cmd_line matches "*reboot*" or
        cmd_line matches "*halt*" or cmd_line matches "*shutdown*"
      )
    )
  )
| eval is_windows_shutdown = if(image_path matches "*\\shutdown.exe", 1, 0)
| eval is_powershell_api = if(
    (image_path matches "*\\powershell.exe" or image_path matches "*\\pwsh.exe") and
    (cmd_line matches "*ExitWindowsEx*" or cmd_line matches "*InitiateSystemShutdown*" or
     cmd_line matches "*NtRaiseHardError*" or cmd_line matches "*ZwRaiseHardError*" or
     cmd_line matches "*EWX_SHUTDOWN*" or cmd_line matches "*EWX_REBOOT*" or
     cmd_line matches "*OptionShutdownSystem*"),
    1, 0)
| eval is_linux_mac_shutdown = if(
    (image_path matches "*/shutdown" or image_path matches "*/reboot" or
     image_path matches "*/halt" or image_path matches "*/poweroff" or
     image_path matches "*/systemctl")
    and not image_path matches "*.exe",
    1, 0)
| eval immediate_shutdown = if(
    cmd_line matches "*/t 0*" or cmd_line matches "*-t 0*" or
    cmd_line matches "* now*" or cmd_line matches "*+0*",
    1, 0)
| eval forced_shutdown = if(
    cmd_line matches "*/f *" or cmd_line matches "*-f *" or
    cmd_line matches "*--force*",
    1, 0)
| eval remote_shutdown = if(cmd_line matches "*/m *" or cmd_line matches "*/m\\\\*", 1, 0)
| eval suspicious_parent = if(
    parent_image matches "*\\cmd.exe" or parent_image matches "*\\powershell.exe" or
    parent_image matches "*\\pwsh.exe" or parent_image matches "*\\wscript.exe" or
    parent_image matches "*\\cscript.exe" or parent_image matches "*\\mshta.exe" or
    parent_image matches "*\\regsvr32.exe" or parent_image matches "*\\rundll32.exe" or
    parent_image matches "*\\msiexec.exe",
    1, 0)
| eval risk_score = is_windows_shutdown + (is_powershell_api * 4) + immediate_shutdown +
                    forced_shutdown + (suspicious_parent * 2) + remote_shutdown
| where risk_score >= 1
| fields _messageTime, Computer, User, image_path, cmd_line, parent_image,
         is_windows_shutdown, is_powershell_api, is_linux_mac_shutdown,
         immediate_shutdown, forced_shutdown, remote_shutdown, suspicious_parent, risk_score
| sort by risk_score desc, _messageTime desc

rule t1529_system_shutdown_reboot {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1529 System Shutdown/Reboot abuse including shutdown.exe with suspicious flags, PowerShell Windows API abuse (ExitWindowsEx, NtRaiseHardError, ZwRaiseHardError), and Linux/macOS native shutdown utilities. Covers destructive malware patterns from WhisperGate, LockerGoga, Olympic Destroyer, and BFG Agonizer."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1529"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path != ""

    (
      // Branch 1: Windows shutdown.exe with shutdown/reboot flags
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)shutdown\.exe$`) and
        (
          re.regex($e.target.process.command_line, `(?i)(/s|/r|-s\s|-r\s)`) and
          re.regex($e.target.process.command_line, `(?i)(/t\s*0|-t\s*0|/f|-f\s|/m\s|/m\\\\|\bnow\b)`)
        )
      )
      or
      // Branch 2: Windows shutdown.exe from suspicious parent
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)shutdown\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(/s|/r|-s\s|-r\s)`) and
        re.regex($e.principal.process.file.full_path,
          `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|msiexec\.exe)$`)
      )
      or
      // Branch 3: PowerShell Windows API abuse
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line,
          `(?i)(ExitWindowsEx|InitiateSystemShutdown|InitiateSystemShutdownExW|NtRaiseHardError|ZwRaiseHardError|EWX_SHUTDOWN|EWX_REBOOT|EWX_POWEROFF|OptionShutdownSystem|SeShutdownPrivilege)`)
      )
      or
      // Branch 4: Linux/macOS native shutdown utilities
      (
        re.regex($e.target.process.file.full_path, `(^|/)( shutdown|reboot|halt|poweroff)$`) and
        not re.regex($e.target.process.file.full_path, `\.exe$`) and
        (
          $e.principal.asset.platform_software.platform_version = "LINUX" or
          $e.principal.asset.platform_software.platform_version = "MAC"
        )
      )
      or
      // Branch 5: systemctl with destructive subcommands
      (
        re.regex($e.target.process.file.full_path, `(^|/)systemctl$`) and
        re.regex($e.target.process.command_line, `(?i)(poweroff|reboot|halt|shutdown)`) and
        not re.regex($e.target.process.file.full_path, `\.exe$`)
      )
    )

  condition:
    $e
}

// T1529 System Shutdown/Reboot Detection
// Branch 1: Windows shutdown.exe abuse
#event_simpleName=ProcessRollup2
| FileName = /(?i)^shutdown\.exe$/
| CommandLine = /(?i)(\/s|\/r|-s\s|-r\s|-s$|-r$)/
| case {
    CommandLine = /(?i)(/t\s*0|-t\s*0)/: ImmediateShutdown := "true";
    * : ImmediateShutdown := "false"
  }
| case {
    CommandLine = /(?i)(/f\s|-f\s|--force)/: ForcedShutdown := "true";
    * : ForcedShutdown := "false"
  }
| case {
    CommandLine = /(?i)(/m\s|/m\\\\)/: RemoteShutdown := "true";
    * : RemoteShutdown := "false"
  }
| case {
    ParentBaseFileName = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|msiexec\.exe)/: SuspiciousParent := "true";
    * : SuspiciousParent := "false"
  }
| RiskScore := 1
| RiskScore := if(ImmediateShutdown = "true", RiskScore + 1, RiskScore)
| RiskScore := if(ForcedShutdown = "true", RiskScore + 1, RiskScore)
| RiskScore := if(RemoteShutdown = "true", RiskScore + 1, RiskScore)
| RiskScore := if(SuspiciousParent = "true", RiskScore + 2, RiskScore)
| DetectionBranch := "WindowsShutdownExe"
| select([@timestamp, ComputerName, UserName, FileName, CommandLine,
          ParentBaseFileName, ImmediateShutdown, ForcedShutdown,
          RemoteShutdown, SuspiciousParent, RiskScore, DetectionBranch])

// Branch 2: PowerShell Windows API abuse
| union [
  #event_simpleName=ProcessRollup2
  | FileName = /(?i)^(powershell|pwsh)\.exe$/
  | CommandLine = /(?i)(ExitWindowsEx|InitiateSystemShutdown|InitiateSystemShutdownExW|NtRaiseHardError|ZwRaiseHardError|EWX_SHUTDOWN|EWX_REBOOT|EWX_POWEROFF|OptionShutdownSystem|SeShutdownPrivilege)/
  | ImmediateShutdown := "true"
  | ForcedShutdown := "true"
  | RemoteShutdown := "false"
  | SuspiciousParent := "true"
  | RiskScore := 4
  | DetectionBranch := "PowerShellAPIAbuse"
  | select([@timestamp, ComputerName, UserName, FileName, CommandLine,
            ParentBaseFileName, ImmediateShutdown, ForcedShutdown,
            RemoteShutdown, SuspiciousParent, RiskScore, DetectionBranch])
]

// Branch 3: Linux/macOS shutdown utilities
| union [
  #event_simpleName=ProcessRollup2
  | FileName = /^(shutdown|reboot|halt|poweroff|systemctl)$/
  | FileName != /\.exe$/
  | case {
      FileName = "systemctl": CommandLine = /(?i)(poweroff|reboot|halt|shutdown)/;
      * : true
    }
  | case {
      CommandLine = /(-t\s*0|\bnow\b|\+0)/: ImmediateShutdown := "true";
      * : ImmediateShutdown := "false"
    }
  | case {
      CommandLine = /(-f\s|--force)/: ForcedShutdown := "true";
      * : ForcedShutdown := "false"
    }
  | RemoteShutdown := "false"
  | case {
      ParentBaseFileName = /(?i)(bash|sh|python|perl|ruby|php|node)/: SuspiciousParent := "true";
      * : SuspiciousParent := "false"
    }
  | RiskScore := 1
  | RiskScore := if(ImmediateShutdown = "true", RiskScore + 1, RiskScore)
  | RiskScore := if(ForcedShutdown = "true", RiskScore + 1, RiskScore)
  | RiskScore := if(SuspiciousParent = "true", RiskScore + 2, RiskScore)
  | DetectionBranch := "LinuxMacShutdown"
  | select([@timestamp, ComputerName, UserName, FileName, CommandLine,
            ParentBaseFileName, ImmediateShutdown, ForcedShutdown,
            RemoteShutdown, SuspiciousParent, RiskScore, DetectionBranch])
]

| where RiskScore >= 1
| sort(RiskScore, order=desc)
| sort(@timestamp, order=desc)