Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1529System Shutdown/Reboot

What it detects

This rule flags command execution events where a process invokes system power state changes such as shutdown, reboot, halt, or poweroff, or where init/telinit is executed in specific argument positions. Such actions can be used to interrupt access to a system or to hinder analysis by forcing restarts or shutdowns. It relies on Linux auditd EXECVE telemetry to capture the executed program and its arguments.

Reporting behind it

Related detections7 linkedT1529 — drag to rearrange

Linux auditd: Detect writes to /proc/sysrq-trigger or sysrq-related config for Magic SysRq abuse

Linux Process Creation: ESXi esxcli VM kill via vm process kill flags

Windows Suspicious Use of shutdown.exe to Log Off a User

Windows Suspicious Shutdown or Reboot via shutdown.exe Command-Line

macOS Shutdown/Reboot Command Execution via /shutdown, /reboot, or /halt Paths

Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity

Cisco AAA commands: shutdown or config-register changes to boot into alternate modes

Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot

Pivot detection · T1529 · 7 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-detect-system-shutdown-reboot-halt-poweroff-via-execve-4cb57c2f

title: "Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot"
id: 539c73b4-c263-4ab7-98bc-0318b1196d7b
status: test
description: This rule flags command execution events where a process invokes system power state changes such as shutdown, reboot, halt, or poweroff, or where init/telinit is executed in specific argument positions. Such actions can be used to interrupt access to a system or to hinder analysis by forcing restarts or shutdowns. It relies on Linux auditd EXECVE telemetry to capture the executed program and its arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_system_shutdown_reboot.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-26
tags:
  - attack.impact
  - attack.t1529
logsource:
  product: linux
  service: auditd
detection:
  execve:
    type: EXECVE
  shutdowncmd:
    - shutdown
    - reboot
    - halt
    - poweroff
  init:
    - init
    - telinit
  initselection:
    - 0
    - 6
  condition: execve and (shutdowncmd or (init and initselection))
falsepositives:
  - Legitimate administrative activity
level: informational
license: DRL-1.1
related:
  - id: 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL