Windows Suspicious Shutdown or Reboot via shutdown.exe Command-Line
Flags shutdown.exe executions that include reboot (/r) or shutdown (/s) switches in the command line.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-01
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags process creation events where the executable is shutdown.exe and the command line contains either /r or /s switches. Attackers may use these switches to disrupt availability, interfere with incident response timing, or trigger system restarts. The detection relies on Windows process creation telemetry capturing the process image path and full command line arguments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_shutdown_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious Shutdown or Reboot via shutdown.exe Command-Line
id: 435cc58b-8dec-4204-8e98-71bf4b8dac51
status: test
description: This rule flags process creation events where the executable is shutdown.exe and the command line contains either /r or /s switches. Attackers may use these switches to disrupt availability, interfere with incident response timing, or trigger system restarts. The detection relies on Windows process creation telemetry capturing the process image path and full command line arguments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_shutdown_execution.yml
author: frack113, Huntrule Team
date: 2022-01-01
tags:
- attack.impact
- attack.t1529
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \shutdown.exe
CommandLine|contains:
- "/r "
- "/s "
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 34ebb878-1b15-4895-b352-ca2eeb99b274
type: derived