Windows Suspicious Use of shutdown.exe to Log Off a User
Flags Windows executions of shutdown.exe with /l to log a user off.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-10-01
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags process creations where shutdown.exe is executed with the /l argument, indicating an interactive logoff action. Attackers may use this to disrupt sessions or interfere with user access while attempting to cover activity. The detection relies on Windows process creation telemetry, matching the image path ending in \shutdown.exe and a command-line substring containing /l.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1529/T1529.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_shutdown_logoff.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-use-of-shutdown-exe-to-log-off-a-user-ec290c06
title: Windows Suspicious Use of shutdown.exe to Log Off a User
id: 0df685d2-e990-474d-a2a9-0c25e61f7244
status: test
description: This rule flags process creations where shutdown.exe is executed with the /l argument, indicating an interactive logoff action. Attackers may use this to disrupt sessions or interfere with user access while attempting to cover activity. The detection relies on Windows process creation telemetry, matching the image path ending in \shutdown.exe and a command-line substring containing /l.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1529/T1529.md
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_shutdown_logoff.yml
author: frack113, Huntrule Team
date: 2022-10-01
tags:
- attack.impact
- attack.t1529
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \shutdown.exe
CommandLine|contains: /l
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ec290c06-9b6b-4338-8b6b-095c0f284f10
type: derived