macOS Process Creation for shutdown, reboot, or halt Commands

title: macOS Process Creation for shutdown, reboot, or halt Commands
id: 441562e4-70c0-4260-8861-61f6ce5e6d86
status: test
description: This rule identifies macOS process creation events where the executed image path ends with shutdown, reboot, or halt, indicating an attempt to power off or restart the host. Such actions can disrupt analyst or user access and may be used to interfere with visibility or operational continuity. It relies on telemetry that captures process creation and the command/image path for system control utilities.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-26
tags:
  - attack.impact
  - attack.t1529
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /shutdown
      - /reboot
      - /halt
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: informational
license: DRL-1.1
related:
  - id: 40b1fbe2-18ea-4ee7-be47-0294285811de
    type: derived