CmdID

CmdID / Commands

halt

Restart, halt, or power off the system. toybox

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD
reboot/halt/poweroff [-fn] [-d DELAY]
-d DELAYWait DELAY before proceeding (in seconds or m/h/d suffix: -d 1.5m = 90s)
-fForce reboot (don't signal init, reboot directly)
-nDon't sync filesystems before reboot

Linux

from tldr-pages, CC BY 4.0

Halt the system.

Halt the system

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Power off the system (same as poweroff)

halt --poweroffIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Reboot the system (same as reboot)

halt --rebootIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Halt immediately without contacting the system manager

halt --forceIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Write the wtmp shutdown entry without halting the system

halt --wtmp-onlyIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

What detects it

Sigma process creation rules that name halt
informationalSystem Shutdown/Reboot - MacOsIgor Fits, Mikhail Larin, oscd.community