MITRE ATT&CK technique
System Shutdown/Reboot detection rulesT1529
System Shutdown/Reboot (T1529) is a MITRE ATT&CK technique in the Impact tactic. This page lists the 8 community-maintained Sigma detection rules in the library mapped to T1529 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux, cisco.
Silence.EDA Detection
criticalDetects Silence EmpireDNSAgent as described in the Group-IP report
windows · ps_script
Cisco Denial of Service
mediumDetect a system being shutdown or put into different boot mode
cisco
ESXi VM Kill Via ESXCLI
mediumDetects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
linux · process_creation
Potential Abuse of Linux Magic System Request Key
mediumDetects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
linux
Suspicious Execution of Shutdown
mediumUse of the commandline to shutdown or reboot windows
windows · process_creation
Suspicious Execution of Shutdown to Log Out
mediumDetects the rare use of the command line tool shutdown to logoff a user
windows · process_creation
System Shutdown/Reboot - Linux
informationalAdversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
linux
System Shutdown/Reboot - MacOs
informationalAdversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
macos · process_creation