Windows Suspicious Use of shutdown.exe to Log Off a User

title: Windows Suspicious Use of shutdown.exe to Log Off a User
id: 0df685d2-e990-474d-a2a9-0c25e61f7244
status: test
description: This rule flags process creations where shutdown.exe is executed with the /l argument, indicating an interactive logoff action. Attackers may use this to disrupt sessions or interfere with user access while attempting to cover activity. The detection relies on Windows process creation telemetry, matching the image path ending in \shutdown.exe and a command-line substring containing /l.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1529/T1529.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_shutdown_logoff.yml
author: frack113, Huntrule Team
date: 2022-10-01
tags:
  - attack.impact
  - attack.t1529
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \shutdown.exe
    CommandLine|contains: /l
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ec290c06-9b6b-4338-8b6b-095c0f284f10
    type: derived