T1529 Google Chronicle · YARA-L

Detect System Shutdown/Reboot in Google Chronicle

Adversaries may shutdown or reboot systems to interrupt access to, or aid in the destruction of, those systems. Shutdown and reboot commands exist across all major operating systems and may be invoked locally or remotely. Adversaries commonly pair T1529 with destructive techniques such as disk wiping (T1561) or inhibiting system recovery (T1490) to force destructive effects to take hold after reboot renders the system unbootable. Windows API functions including ExitWindowsEx, InitiateSystemShutdown, NtRaiseHardError, and ZwRaiseHardError are abused to programmatically force shutdowns or trigger blue screens of death (BSOD). Observed extensively in destructive malware: LockerGoga, Olympic Destroyer, WhisperGate (ExitWindowsEx with EWX_SHUTDOWN), AcidRain, AcidPour, Apostle, DCSrv, MultiLayer Wiper, BFG Agonizer (NtRaiseHardError BSOD), and Qilin ransomware targeting backup servers.

MITRE ATT&CK

Tactic
Impact
Technique
T1529 System Shutdown/Reboot
Canonical reference
https://attack.mitre.org/techniques/T1529/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule t1529_system_shutdown_reboot {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1529 System Shutdown/Reboot abuse including shutdown.exe with suspicious flags, PowerShell Windows API abuse (ExitWindowsEx, NtRaiseHardError, ZwRaiseHardError), and Linux/macOS native shutdown utilities. Covers destructive malware patterns from WhisperGate, LockerGoga, Olympic Destroyer, and BFG Agonizer."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1529"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path != ""

    (
      // Branch 1: Windows shutdown.exe with shutdown/reboot flags
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)shutdown\.exe$`) and
        (
          re.regex($e.target.process.command_line, `(?i)(/s|/r|-s\s|-r\s)`) and
          re.regex($e.target.process.command_line, `(?i)(/t\s*0|-t\s*0|/f|-f\s|/m\s|/m\\\\|\bnow\b)`)
        )
      )
      or
      // Branch 2: Windows shutdown.exe from suspicious parent
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)shutdown\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(/s|/r|-s\s|-r\s)`) and
        re.regex($e.principal.process.file.full_path,
          `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|msiexec\.exe)$`)
      )
      or
      // Branch 3: PowerShell Windows API abuse
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line,
          `(?i)(ExitWindowsEx|InitiateSystemShutdown|InitiateSystemShutdownExW|NtRaiseHardError|ZwRaiseHardError|EWX_SHUTDOWN|EWX_REBOOT|EWX_POWEROFF|OptionShutdownSystem|SeShutdownPrivilege)`)
      )
      or
      // Branch 4: Linux/macOS native shutdown utilities
      (
        re.regex($e.target.process.file.full_path, `(^|/)( shutdown|reboot|halt|poweroff)$`) and
        not re.regex($e.target.process.file.full_path, `\.exe$`) and
        (
          $e.principal.asset.platform_software.platform_version = "LINUX" or
          $e.principal.asset.platform_software.platform_version = "MAC"
        )
      )
      or
      // Branch 5: systemctl with destructive subcommands
      (
        re.regex($e.target.process.file.full_path, `(^|/)systemctl$`) and
        re.regex($e.target.process.command_line, `(?i)(poweroff|reboot|halt|shutdown)`) and
        not re.regex($e.target.process.file.full_path, `\.exe$`)
      )
    )

  condition:
    $e
}
high severity high confidence

Chronicle YARA-L 2.0 rule detecting T1529 System Shutdown/Reboot abuse across Windows, Linux, and macOS endpoints. Five detection branches cover: shutdown.exe with immediate/forced/remote flags, shutdown.exe spawned from suspicious LOLBin parents (cmd, wscript, mshta, etc.), PowerShell invoking Windows API shutdown functions (ExitWindowsEx, NtRaiseHardError, ZwRaiseHardError) as seen in destructive malware, and Linux/macOS native shutdown utilities including systemctl.

Data Sources

Chronicle UDM (Google Security Operations)Endpoint telemetry via Chronicle forwarderWindows Sysmon via Chronicle ingestionLinux/macOS audit logs via Chronicle forwarder

Required Tables

UDM Events (PROCESS_LAUNCH)

False Positives & Tuning

  • Enterprise endpoint management tools (Microsoft Endpoint Configuration Manager, Jamf, Intune) that issue scheduled shutdowns and reboots via PowerShell or system utilities with /f or /t 0 flags
  • Linux infrastructure automation using Ansible or SaltStack that calls 'systemctl reboot' or 'shutdown -h now' as part of rolling update pipelines
  • Cloud instance lifecycle hooks that invoke shutdown commands when auto-scaling groups terminate instances, generating shutdown process events on ephemeral hosts

Other platforms for T1529

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Windows Shutdown Scheduled and Aborted (Safe Telemetry Test)

    Expected signal: Sysmon Event ID 1: Process Create for shutdown.exe with CommandLine containing '/s /t 300 /c df00tech-detection-test'. System Event Log Event ID 1074 recording the initiated shutdown with process name and user SID. Second Sysmon Event ID 1 for shutdown.exe /a (abort, generates its own process creation event). Security Event ID 4688 for both executions if process auditing is enabled.

  2. Test 2 Forced Immediate Reboot — Wiper Simulation (Lab VM Only)

    Expected signal: Sysmon Event ID 1 (captured before reboot): Image=C:\Windows\System32\shutdown.exe, CommandLine='shutdown.exe /r /f /t 0'. System Event Log Event ID 1074 recorded immediately. Security Event ID 4688 if auditing enabled. After reboot: System Event Log Event ID 6006 (clean shutdown). Prefetch file SHUTDOWN.EXE-*.pf updated.

  3. Test 3 PowerShell ExitWindowsEx API Reference (Safe — No Actual Shutdown)

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'ExitWindowsEx'. PowerShell ScriptBlock Log Event ID 4104 in Microsoft-Windows-PowerShell/Operational showing the DllImport declaration. No actual shutdown occurs — P/Invoke signature is defined but the method is never invoked.

  4. Test 4 Linux Shutdown Scheduled and Cancelled (Safe Telemetry Test)

    Expected signal: Auditd EXECVE syscall record or Sysmon for Linux Event ID 1: execution of shutdown with arguments '-h +15 df00tech-detection-test'. Broadcast message to all logged-in users via wall. Second execution record for shutdown -c with cancellation message. /var/log/syslog or journald entries for both the scheduled shutdown and cancellation. sudo pam_unix authentication log entries.

Last updated: 2026-04-20 Research depth: deep
References (12)

Response Playbook

Triage

  1. Identify the initiating process: check ParentImage/InitiatingProcessFileName — was shutdown spawned by a scripting host (wscript.exe, cscript.exe, mshta.exe), a LOLBin (rundll32.exe, regsvr32.exe), or PowerShell? These are not legitimate parents for shutdown commands and require immediate escalation
  2. Examine the command line for urgency indicators: /t 0 combined with /f (force close all applications, immediate, no abort window) is never used by legitimate RMM tools or Windows Update — treat this combination as confirmed malicious until proven otherwise
  3. Check the user account context: was this executed by a service account outside a change window, by a domain admin with no corresponding ticket, or by SYSTEM without a Windows Update event (Event ID 19/20 in Microsoft-Windows-WindowsUpdateClient) preceding it?
  4. Review the 60-minute window BEFORE the shutdown for correlated destructive activity: shadow copy deletion (vssadmin delete shadows, wmic shadowcopy delete), BCDEdit recovery disablement (bcdedit /set recoveryenabled no), disk write activity to \\.\PhysicalDrive paths, or mass file encryption — any of these combined with a shutdown is a confirmed wiper/ransomware scenario
  5. For PowerShell API abuse (ExitWindowsEx, NtRaiseHardError, ZwRaiseHardError): check PowerShell ScriptBlock Log Event ID 4104 for the full deobfuscated script; note that NtRaiseHardError with OptionShutdownSystem typically requires SeShutdownPrivilege — check for preceding Access Token Manipulation (T1134) events
  6. For remote shutdown (/m flag): extract target hostnames from the command line argument and immediately check whether those hosts are also showing destructive activity — multi-host remote shutdown indicates automated propagation

Containment

  1. If system has not yet shut down and destructive activity is confirmed: initiate immediate memory acquisition via EDR live response (capture volatile process list, open network connections, loaded modules) before isolation — memory forensics is irretrievably lost at shutdown
  2. Network-isolate the endpoint using EDR group isolation policy or an emergency VLAN ACL — do NOT rely on the shutdown command itself being aborted via shutdown /a unless confirmed the timer is still running
  3. If remote shutdown (/m flag) was used against multiple targets: immediately identify all target hosts from the command line arguments, cross-reference with Active Directory, and initiate parallel isolation — this is an automated wiper propagation scenario requiring coordinated response
  4. Disable the initiating user account in Active Directory (Disable-ADAccount) and revoke all active Kerberos tickets (klist purge on affected hosts or domain-wide if account is privileged) — do not merely reset the password as the attacker likely has credential material for re-authentication
  5. Verify backup integrity before attempting recovery: wiper campaigns specifically target backup infrastructure (Qilin targets backup servers) — confirm backups are online, untampered, and recoverable before proceeding with restoration planning
  6. If system has already rebooted and fails to boot (indicating MBR/VBR wipe): treat the disk as forensic evidence, do NOT attempt in-place repair — image the disk before any recovery attempts preserve chain of custody

Evidence Collection

  1. Windows System Event Log Event ID 1074 (User-Initiated Restart/Shutdown): records the initiating process name, user SID, shutdown type code, and comment string — primary evidence of who and what triggered the shutdown
  2. Windows System Event Log Event ID 6006 (clean shutdown completed) and Event ID 6008 (unexpected/dirty shutdown): 6008 after wiper activity indicates the system was forced off without proper shutdown sequence
  3. Windows Security Event ID 4688 (Process Creation with Command Line): captures shutdown.exe invocation in environments with process auditing enabled — confirm 'Include command line in process creation events' GPO is active
  4. Sysmon Event ID 1 (Process Create): full command line, parent process, user SID, and hash of shutdown.exe — verify the hash matches the legitimate Windows binary to rule out masqueraded malware
  5. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational): full deobfuscated script content when PowerShell API abuse is detected — captures ExitWindowsEx or NtRaiseHardError call with parameters
  6. Prefetch files: C:\Windows\Prefetch\SHUTDOWN.EXE-*.pf — confirms execution timestamp and loaded DLLs, survives a clean reboot (destroyed by wiper if MFT is wiped)
  7. Windows System Event Log Service Control Manager Event ID 7036 (service state change): review the sequence of services stopped before shutdown — abnormal stop order (e.g., security services stopping before shutdown command) indicates pre-shutdown tampering
  8. Linux: journald persistent log at /var/log/journal/ — contains systemctl poweroff/reboot entries with initiating user UID and timestamp; also check /var/log/auth.log for sudo shutdown invocations
  9. Linux: /var/log/wtmp read via `last -x | grep -E 'shutdown|reboot'` — provides historical shutdown audit trail with timestamps and terminal
  10. ESXi: /var/log/hostd.log and /var/log/shell.log — record vim-cmd vmsvc/power.shutdown and esxcli system shutdown commands with source IP and credentials used

Escalation Criteria

  • !Shutdown immediately follows confirmed destructive activity in the preceding 30-60 minutes: shadow copy deletion, BCDEdit recovery disablement, disk wipe targeting PhysicalDrive, or mass file modification consistent with encryption — this combination is definitive ransomware/wiper execution
  • !PowerShell command line contains ExitWindowsEx, NtRaiseHardError, ZwRaiseHardError, or OptionShutdownSystem — these programmatic Windows API shutdown methods are not used by any legitimate administrative tooling and constitute a near-zero false-positive indicator of malware
  • !Shutdown initiated by a non-privileged user account, a service account without a corresponding change ticket, or SYSTEM with no preceding Windows Update events — any of these indicate unauthorized shutdown
  • !Remote shutdown (/m flag) targeting 3 or more hosts within a 30-minute window — indicates automated wiper/ransomware propagation pattern consistent with Olympic Destroyer and similar campaigns
  • !System fails to boot after the shutdown event — strong indicator of MBR/VBR wipe (T1561.002) or boot configuration destruction (T1490); escalate to incident commander and initiate IR retainer engagement
  • !Shutdown preceded by SeShutdownPrivilege acquisition via token impersonation or privilege escalation — indicates deliberate staging for programmatic shutdown API calls consistent with Agrius group's BFG Agonizer and MultiLayer Wiper

Investigation Guide

Related Techniques

T1561 — Disk Wipe (most common precursor; wiper forces reboot to trigger unbootable state after MBR/VBR destruction)T1561.002 — Disk Structure Wipe (MBR/VBR overwrite followed by forced reboot — system cannot boot, maximizing damage)T1490 — Inhibit System Recovery (shadow copy and backup deletion before shutdown prevents rollback after reboot)T1489 — Service Stop (security and backup services stopped before shutdown to maximize damage window and prevent interference)T1485 — Data Destruction (data destruction payload completes then system rebooted to prevent forensic analysis of running state)T1134 — Access Token Manipulation (SeShutdownPrivilege acquisition via token manipulation enables NtRaiseHardError and ExitWindowsEx API calls)T1059.001 — PowerShell (primary vehicle for ExitWindowsEx, NtRaiseHardError, and ZwRaiseHardError API abuse)T1059.008 — Network Device CLI (reload command on Cisco/Juniper devices is the network device equivalent of T1529)T1486 — Data Encrypted for Impact (ransomware families like Maze and Qilin reboot systems after encryption to prevent recovery)

Forensic Artifacts

  • >Windows System Event Log Event ID 1074: records process name, user SID, shutdown type (0=shutdown, 2=reboot, 5=legacy), reason code, and optional comment — most complete single artifact for shutdown attribution
  • >Windows System Event Log Event ID 6006 (clean shutdown) and 6008 (unexpected/dirty shutdown): 6008 with preceding destructive activity is a high-fidelity wiper indicator
  • >Windows Security Event ID 4688 with New Process Name = shutdown.exe and Subject fields showing initiating user — requires 'Audit Process Creation' and 'Include command line in process creation events' GPO enabled
  • >Prefetch: C:\Windows\Prefetch\SHUTDOWN.EXE-*.pf — execution timestamps and referenced DLLs; absence of this file when shutdown.exe was executed may indicate prefetch disabling (T1070) by the attacker
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\CrashDumpEnabled — if set to 0 before BSOD-inducing shutdown (NtRaiseHardError), attacker disabled crash dump to prevent memory forensics
  • >Sysmon Event ID 1 (Process Create): parent-child chain for shutdown.exe invocation with MD5/SHA256 hash to verify binary authenticity — masqueraded malware may use shutdown.exe filename
  • >PowerShell ScriptBlock Log (Event ID 4104 in Microsoft-Windows-PowerShell/Operational): full deobfuscated script content showing API function declarations and shutdown flag values
  • >Linux journald persistent log at /var/log/journal/: survives clean reboots; contains systemctl/shutdown invocations with user UID, PID, and exact arguments
  • >Linux /var/log/wtmp via `last -x | grep -E 'shutdown|reboot'`: historical shutdown audit trail with terminal context
  • >ESXi /var/log/hostd.log: records vim-cmd vmsvc/power.shutdown and esxcli system shutdown poweroff commands with authenticated user and source IP for VM and host shutdown events

Tuning Guidance

Start by building an allowlist of legitimate shutdown actors in your environment: (1) RMM agents — identify the parent process names for ConnectWise Control (ScreenConnect.ClientService.exe), Kaseya VSA (AgentMon.exe), TeamViewer (TeamViewer_Service.exe), and suppress shutdown.exe events where InitiatingProcessFileName exactly matches these known-good agents; (2) Windows Update — suppress events where InitiatingProcessFileName is TrustedInstaller.exe or where the command line contains /r without /f and without /t 0; (3) SCCM/Intune — suppress events from the service accounts configured for software deployment during known maintenance windows. For the PowerShell API abuse branch (ExitWindowsEx, NtRaiseHardError), do NOT suppress — legitimate software virtually never invokes these shutdown APIs from PowerShell command lines; the false positive rate for this branch is near zero. Tune the RiskScore threshold rather than suppressing entire pattern classes: RiskScore >= 1 for alerting (broad), >= 3 for high-priority triage (immediate/forced + suspicious parent), >= 4 for PowerShell API abuse (automatic escalation). Enable Windows Security Event ID 1074 collection via your SIEM to provide attribution context for every alert. On Linux, suppress systemctl reboot events where the initiating process matches your known update manager (unattended-upgrades, yum-cron, dnf-automatic) using a service account allowlist.

Hunting Queries

Hunts for systems where a shutdown/reboot command occurs within 60 minutes of confirmed destructive precursor activity (shadow copy deletion, BCDEdit recovery disablement, diskpart operations). This temporal correlation is the strongest available indicator of wiper/ransomware completion — seen in Olympic Destroyer, WhisperGate, Apostle, AcidRain, and MultiLayer Wiper. Systems matching this query require immediate incident response regardless of the shutdown command's specifics.

Hunting — KQL
kql 
// Hunt: shutdown correlated with destructive precursor activity within 60 minutes
let DestructiveActivity = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "wmic.exe", "diskpart.exe", "cipher.exe")
| where ProcessCommandLine has_any (
    "shadowcopy delete", "delete shadows", "delete catalog",
    "recoveryenabled no", "bootstatuspolicy ignoreallfailures",
    "delete systemstatebackup", "/w:"
  )
| project DestructiveTime=Timestamp, DeviceName, DestructiveProcess=FileName, DestructiveCmdLine=ProcessCommandLine;
let ShutdownEvents = DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "shutdown.exe" and ProcessCommandLine has_any ("/s", "/r"))
   or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("ExitWindowsEx", "NtRaiseHardError", "ZwRaiseHardError"))
| project ShutdownTime=Timestamp, DeviceName, ShutdownProcess=FileName, ShutdownCmdLine=ProcessCommandLine;
ShutdownEvents
| join kind=inner DestructiveActivity on DeviceName
| where ShutdownTime > DestructiveTime
| where datetime_diff('minute', ShutdownTime, DestructiveTime) <= 60
| extend MinutesBetween = datetime_diff('minute', ShutdownTime, DestructiveTime)
| project ShutdownTime, DestructiveTime, MinutesBetween, DeviceName, ShutdownCmdLine, DestructiveProcess, DestructiveCmdLine
| sort by MinutesBetween asc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\shutdown.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
(CommandLine="*/s*" OR CommandLine="*/r*" OR CommandLine="*ExitWindowsEx*" OR CommandLine="*NtRaiseHardError*")
| eval shutdown_time=_time
| eval is_shutdown=1
| append [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\vssadmin.exe" OR Image="*\\wbadmin.exe" OR Image="*\\bcdedit.exe" OR Image="*\\diskpart.exe")
    (CommandLine="*shadowcopy*delete*" OR CommandLine="*recoveryenabled*no*" OR CommandLine="*delete shadows*" OR CommandLine="*delete catalog*")
    | eval is_destructive=1
]
| stats values(CommandLine) as Commands, values(is_shutdown) as HasShutdown, values(is_destructive) as HasDestructive, min(_time) as earliest, max(_time) as latest by host
| where HasShutdown=1 AND HasDestructive=1
| eval TimeSpanMinutes=round((latest-earliest)/60,1)
| where TimeSpanMinutes <= 60
| table host, TimeSpanMinutes, Commands, earliest, latest
| sort TimeSpanMinutes

Hunts for a single source host issuing remote shutdown commands (shutdown /m) against 3 or more unique targets within a 30-minute window. This worm-like propagation pattern — one infected host forcing reboots across the environment — was observed in Olympic Destroyer and is consistent with automated wiper deployment. Single source with high UniqueTargets count is a critical escalation indicator regardless of other signals.

Hunting — KQL
kql 
// Hunt: multi-host remote shutdown propagation (automated wiper spread pattern)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "shutdown.exe"
| where ProcessCommandLine has "/m"
| extend TargetHost = extract(@"/m\s+([\\\\]+[^\s]+|\S+)", 1, ProcessCommandLine)
| where isnotempty(TargetHost)
| summarize
    RemoteShutdownCount = count(),
    UniqueTargets = dcount(TargetHost),
    TargetList = make_set(TargetHost, 20),
    Accounts = make_set(AccountName),
    CommandLines = make_set(ProcessCommandLine)
  by SourceDevice=DeviceName, bin(Timestamp, 30m)
| where UniqueTargets >= 3
| sort by UniqueTargets desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image="*\\shutdown.exe" CommandLine="*/m*"
| rex field=CommandLine "/m\s+(?<TargetHost>[^\s]+)"
| where isnotnull(TargetHost) AND len(TargetHost) > 2
| bin _time span=30m
| stats count as RemoteShutdownCount, dc(TargetHost) as UniqueTargets, values(TargetHost) as TargetList, values(User) as Accounts by host, _time
| where UniqueTargets >= 3
| sort - UniqueTargets

Hunts for user-account-initiated shutdown commands outside business hours (before 06:00 or after 22:00 UTC) or on weekends. Ransomware and wiper campaigns deliberately execute during off-hours to maximize dwell time and minimize rapid response. This pattern excludes SYSTEM, LOCAL SERVICE, and NETWORK SERVICE accounts (legitimate scheduled reboots) while surfacing human-account shutdowns at unusual times — a consistent behavioral indicator across ransomware groups including Qilin and LockerGoga.

Hunting — KQL
kql 
// Hunt: off-hours shutdown by non-system accounts (attacker timing to evade detection)
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName =~ "shutdown.exe"
| where ProcessCommandLine has_any ("/s", "/r")
| where AccountName !in~ ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| extend HourUTC = datetime_part("Hour", Timestamp)
| extend DayOfWeek = dayofweek(Timestamp)
| extend IsOffHours = HourUTC < 6 or HourUTC >= 22
| extend IsWeekend = DayOfWeek in (0d, 6d)
| where IsOffHours or IsWeekend
| summarize
    Count = count(),
    Devices = dcount(DeviceName),
    DeviceList = make_set(DeviceName),
    CommandLines = make_set(ProcessCommandLine)
  by AccountName, IsOffHours, IsWeekend, bin(Timestamp, 1h)
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image="*\\shutdown.exe" (CommandLine="*/s*" OR CommandLine="*/r*")
NOT (User="SYSTEM" OR User="LOCAL SERVICE" OR User="NETWORK SERVICE" OR User="NT AUTHORITY\\SYSTEM")
| eval hour=tonumber(strftime(_time, "%H"))
| eval dow=tonumber(strftime(_time, "%w"))
| eval IsOffHours=if(hour < 6 OR hour >= 22, 1, 0)
| eval IsWeekend=if(dow = 0 OR dow = 6, 1, 0)
| where IsOffHours=1 OR IsWeekend=1
| bin _time span=1h
| stats count as ShutdownCount, dc(host) as UniqueHosts, values(host) as HostList, values(CommandLine) as Commands by User, IsOffHours, IsWeekend, _time
| sort - ShutdownCount

Atomic Red Team Tests

Test 1 Windows Shutdown Scheduled and Aborted (Safe Telemetry Test)
windows

Schedules a system shutdown 5 minutes in the future then immediately aborts it using shutdown /a. This generates the Sysmon Event ID 1 process creation event for shutdown.exe with /s flag, populates System Event Log Event ID 1074, and then creates a second process creation event for the abort — all without actually shutting down the system. Simulates the telemetry that would be generated by malware scheduling an immediate post-wipe shutdown.

Command

powershell 
cmd.exe /c "shutdown.exe /s /t 300 /c "df00tech-detection-test" && timeout /t 3 /nobreak && shutdown.exe /a"

Cleanup

powershell 
shutdown.exe /a 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for shutdown.exe with CommandLine containing '/s /t 300 /c df00tech-detection-test'. System Event Log Event ID 1074 recording the initiated shutdown with process name and user SID. Second Sysmon Event ID 1 for shutdown.exe /a (abort, generates its own process creation event). Security Event ID 4688 for both executions if process auditing is enabled.

Expected Detection

KQL WindowsShutdown branch fires: FileName=shutdown.exe, ProcessCommandLine has '/s', ImmediateShutdown=false (300s delay), ForcedShutdown=false, RiskScore=1. SPL fires: IsWindowsShutdownExe=1, RiskScore=1. Parent process is cmd.exe which scores SuspiciousParent=1 in some configurations, raising RiskScore to 3.

Test 2 Forced Immediate Reboot — Wiper Simulation (Lab VM Only)
windows

Executes an immediate forced system reboot mirroring the exact command line used by APT37 malware (shutdown /r /t 1 after MBR wipe), LockerGoga, and similar destructive malware. WARNING: This WILL immediately reboot the system. Only execute in a dedicated disposable lab VM with no production workloads. The /f flag forces all applications to close without saving data, and /t 0 eliminates the abort window — the highest-risk combination in this technique.

Command

powershell 
shutdown.exe /r /f /t 0

Expected Telemetry

Sysmon Event ID 1 (captured before reboot): Image=C:\Windows\System32\shutdown.exe, CommandLine='shutdown.exe /r /f /t 0'. System Event Log Event ID 1074 recorded immediately. Security Event ID 4688 if auditing enabled. After reboot: System Event Log Event ID 6006 (clean shutdown). Prefetch file SHUTDOWN.EXE-*.pf updated.

Expected Detection

KQL: ImmediateShutdown=true, ForcedShutdown=true, RiskScore=2 minimum (higher if parent is suspicious). SPL: ImmediateShutdown=1, ForcedShutdown=1, RiskScore >= 2. This combination warrants immediate escalation per playbook criteria.

Test 3 PowerShell ExitWindowsEx API Reference (Safe — No Actual Shutdown)
windows

Uses PowerShell to define the ExitWindowsEx P/Invoke signature without calling it — the command line still contains 'ExitWindowsEx' which is the string the detection queries match on. This safely generates the process creation telemetry that wiper malware like WhisperGate (which calls ExitWindowsEx with EWX_SHUTDOWN flag 0x00000001) produces during execution. In a real attack, the adversary would require SeShutdownPrivilege for the call to succeed.

Command

powershell 
powershell.exe -NoProfile -Command "$sig = '[DllImport(\"user32.dll\")] public static extern bool ExitWindowsEx(uint uFlags, uint dwReason);'; Write-Host 'ExitWindowsEx P/Invoke signature loaded - detection test only, no shutdown called'"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'ExitWindowsEx'. PowerShell ScriptBlock Log Event ID 4104 in Microsoft-Windows-PowerShell/Operational showing the DllImport declaration. No actual shutdown occurs — P/Invoke signature is defined but the method is never invoked.

Expected Detection

KQL PowerShellAPIAbuse branch fires: FileName in (powershell.exe), ProcessCommandLine has 'ExitWindowsEx', RiskScore=4 (maximum baseline). SPL: IsPowerShellAPI=1, RiskScore=4. This branch should auto-escalate per playbook criteria regardless of other context.

Test 4 Linux Shutdown Scheduled and Cancelled (Safe Telemetry Test)
linux

On Linux systems, schedules a shutdown 15 minutes in the future and then immediately cancels it. Generates process creation telemetry for the shutdown command with time argument — the pattern used by AcidRain and AcidPour wiper malware after completing disk wiping operations on embedded Linux devices. Safe to execute on any Linux system; the cancellation immediately follows the schedule command.

Command

bash 
sudo shutdown -h +15 'df00tech-detection-test' ; sleep 2 ; sudo shutdown -c 'df00tech-detection-test cancelled'

Cleanup

bash 
sudo shutdown -c 2>/dev/null || true

Expected Telemetry

Auditd EXECVE syscall record or Sysmon for Linux Event ID 1: execution of shutdown with arguments '-h +15 df00tech-detection-test'. Broadcast message to all logged-in users via wall. Second execution record for shutdown -c with cancellation message. /var/log/syslog or journald entries for both the scheduled shutdown and cancellation. sudo pam_unix authentication log entries.

Expected Detection

KQL LinuxMacShutdown branch fires: FileName='shutdown', DeviceOSPlatform='Linux', ImmediateShutdown=false (not 'now'), RiskScore=1 (or higher if SuspiciousParent). SPL: IsLinuxMacShutdown=1, RiskScore=1. The cancellation does not generate a detection — only the schedule command fires the alert.

Related Detections

Tactic Hub

TA0040 Impact

Related Techniques

T1561 Disk Wipe T1561.002 Disk Structure Wipe T1490 Inhibit System Recovery T1489 Service Stop T1485 Data Destruction T1134 Access Token Manipulation T1059.001 PowerShell T1059.008 Network Device CLI T1486 Data Encrypted for Impact

Same Tactic: Impact

Popular Detections