Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot
Identifies Linux shutdown/reboot command execution patterns using auditd execve telemetry.
- Product
- linux
- Service
- auditd
- Author
- Igor Fits, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-15
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags command execution events where a process invokes system power state changes such as shutdown, reboot, halt, or poweroff, or where init/telinit is executed in specific argument positions. Such actions can be used to interrupt access to a system or to hinder analysis by forcing restarts or shutdowns. It relies on Linux auditd EXECVE telemetry to capture the executed program and its arguments.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot"
id: 539c73b4-c263-4ab7-98bc-0318b1196d7b
status: test
description: This rule flags command execution events where a process invokes system power state changes such as shutdown, reboot, halt, or poweroff, or where init/telinit is executed in specific argument positions. Such actions can be used to interrupt access to a system or to hinder analysis by forcing restarts or shutdowns. It relies on Linux auditd EXECVE telemetry to capture the executed program and its arguments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_system_shutdown_reboot.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-26
tags:
- attack.impact
- attack.t1529
logsource:
product: linux
service: auditd
detection:
execve:
type: EXECVE
shutdowncmd:
- shutdown
- reboot
- halt
- poweroff
init:
- init
- telinit
initselection:
- 0
- 6
condition: execve and (shutdowncmd or (init and initselection))
falsepositives:
- Legitimate administrative activity
level: informational
license: DRL-1.1
related:
- id: 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f
type: derived