macOS Shutdown/Reboot Command Execution via /shutdown, /reboot, or /halt Paths

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1529System Shutdown/Reboot

What it detects

This rule flags process executions where the process image path ends with /shutdown, /reboot, or /halt on macOS. Attackers can use system restarts or shutdowns to disrupt access to a target host and hinder incident response, or as part of broader impact activities. Telemetry relies on process creation data that includes the executing image path.

Reporting behind it

Related detections7 linkedT1529 — drag to rearrange

Linux auditd: Detect writes to /proc/sysrq-trigger or sysrq-related config for Magic SysRq abuse

Linux Process Creation: ESXi esxcli VM kill via vm process kill flags

Windows Suspicious Use of shutdown.exe to Log Off a User

Windows Suspicious Shutdown or Reboot via shutdown.exe Command-Line

Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot

Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity

Cisco AAA commands: shutdown or config-register changes to boot into alternate modes

macOS Shutdown/Reboot Command Execution via /shutdown, /reboot, or /halt Paths

Pivot detection · T1529 · 7 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-creation-for-shutdown-reboot-or-halt-commands-40b1fbe2

title: macOS Shutdown/Reboot Command Execution via /shutdown, /reboot, or /halt Paths
id: 441562e4-70c0-4260-8861-61f6ce5e6d86
status: test
description: This rule flags process executions where the process image path ends with /shutdown, /reboot, or /halt on macOS. Attackers can use system restarts or shutdowns to disrupt access to a target host and hinder incident response, or as part of broader impact activities. Telemetry relies on process creation data that includes the executing image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-26
tags:
  - attack.impact
  - attack.t1529
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /shutdown
      - /reboot
      - /halt
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: informational
license: DRL-1.1
related:
  - id: 40b1fbe2-18ea-4ee7-be47-0294285811de
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL