Linux Auditd: Detect System Shutdown, Reboot, Halt, Poweroff via execve

title: "Linux Auditd: Detect System Shutdown, Reboot, Halt, Poweroff via execve"
id: 539c73b4-c263-4ab7-98bc-0318b1196d7b
status: test
description: This rule flags process executions on Linux captured by auditd where a command invokes system shutdown or reboot functionality. Such actions can be used by an attacker to disrupt access to a system or to hinder response and recovery efforts. Detection relies on auditd execve telemetry for executions of common shutdown commands and for init-style process executions associated with run-level transitions (init and telinit).
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_system_shutdown_reboot.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-26
tags:
  - attack.impact
  - attack.t1529
logsource:
  product: linux
  service: auditd
detection:
  execve:
    type: EXECVE
  shutdowncmd:
    - shutdown
    - reboot
    - halt
    - poweroff
  init:
    - init
    - telinit
  initselection:
    - 0
    - 6
  condition: execve and (shutdowncmd or (init and initselection))
falsepositives:
  - Legitimate administrative activity
level: informational
license: DRL-1.1
related:
  - id: 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f
    type: derived