System Shutdown/Reboot (T1529) is an Impact technique. Adversaries shut down or reboot systems to interrupt access, or to help destroy them. MITRE lists ESXi, Linux, macOS, network devices and Windows.
How attackers use it
Operating systems include commands to shut down or restart a machine, and sometimes to do it to a remote computer or a network device through its command line, for example the reload command. Virtual machines can also be stopped through hypervisor or cloud consoles and command line tools.
MITRE notes that a shutdown disrupts access for legitimate users and also slows incident response and recovery. On Windows, adversaries may use API functions such as InitializeSystemShutdownExW or ExitWindowsEx to force a restart, or NtRaiseHardError and ZwRaiseHardError with the shutdown option to deliver a blue screen. They may need SeShutdownPrivilege, for example through Access Token Manipulation. In some cases the system may not boot again.
Adversaries may do this after impacting a system in other ways, such as Disk Structure Wipe or Inhibit System Recovery, to speed the intended effect.
How to detect it
MITRE's analytics suggest comparing the shutdown with expected context:
- Windows: shutdown commands such as shutdown.exe or Restart-Computer, correlated with host status events 1074 and 6006, with no related administrative context, for example the user not being in a helpdesk group.
- Linux: shutdown, reboot or systemctl poweroff recorded by auditd or syslog, outside scheduled maintenance windows or approved users.
- macOS: shutdown, reboot or osascript shutdown calls in unified logs, and unexpected shutdown sequences started by a script or GUI.
- ESXi: esxcli system shutdown or vim-cmd vmsvc/power.shutdown outside maintenance windows or by unusual users, with hostd.log and shell logs correlated.
- Network devices: reload commands without scheduled maintenance, checked against TACACS+ or AAA logs.
The common test is simple. Was this restart planned, and was the person who ran it allowed to?
How to reduce the risk
MITRE lists no specific mitigations. Reduce exposure by limiting who has shutdown rights and hypervisor access, requiring change tickets for restarts of critical systems, and sending logs off the host so they survive a reboot.
Check your own environment
A read only Windows check for recent shutdown and restart events (event ID 1074 records who started one and why):
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 20 |
Select-Object TimeCreated, Message
Compare each entry against your maintenance calendar. Confirm that hypervisor and network device logs reach a central system, and that shutdown rights are held by a short, named list of people.
Quick check
Which Windows event IDs does MITRE name for this detection?
1074 and 6006, host status events that can be correlated with shutdown command execution.
