TA0040 · IMPACT
System Shutdown/Reboot
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device.
Detect it with
Use process monitoring to monitor the execution and command line parameters of binaries involved in shutting down or rebooting systems. Windows event logs may also designate activity associated with a shutdown/reboot, ex.
Why it matters on shift
System Shutdown/Reboot is one of the concrete ways adversaries achieve impact. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After impact, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.
Kill-chain context