Windows Suspicious Shutdown or Reboot via shutdown.exe Command-Line

title: Windows Suspicious Shutdown or Reboot via shutdown.exe Command-Line
id: 435cc58b-8dec-4204-8e98-71bf4b8dac51
status: test
description: This rule flags process creation events where the executable is shutdown.exe and the command line contains either /r or /s switches. Attackers may use these switches to disrupt availability, interfere with incident response timing, or trigger system restarts. The detection relies on Windows process creation telemetry capturing the process image path and full command line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_shutdown_execution.yml
author: frack113, Huntrule Team
date: 2022-01-01
tags:
  - attack.impact
  - attack.t1529
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \shutdown.exe
    CommandLine|contains:
      - "/r "
      - "/s "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 34ebb878-1b15-4895-b352-ca2eeb99b274
    type: derived