CmdID

CmdID / Commands

reboot

Restart, halt, or power off the system. toybox

On Linux, macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD
reboot/halt/poweroff [-fn] [-d DELAY]
-d DELAYWait DELAY before proceeding (in seconds or m/h/d suffix: -d 1.5m = 90s)
-fForce reboot (don't signal init, reboot directly)
-nDon't sync filesystems before reboot

Linux

from tldr-pages, CC BY 4.0

Reboot the system.

Reboot the system

rebootIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Power off the system (same as poweroff)

reboot --poweroffIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Halt (terminates all processes and shuts down the CPU) the system (same as halt)

reboot --haltIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Reboot immediately without contacting the system manager

reboot --forceIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Write the wtmp shutdown entry without rebooting the system

reboot --wtmp-onlyIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

macOS

from tldr-pages, CC BY 4.0

Reboot the system.

Reboot immediately

sudo rebootIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

Reboot immediately without gracefully shutting down

sudo reboot -qIdentify

Trips 1 Sigma rule: informationalSystem Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community

What detects it

Sigma process creation rules that name reboot
informationalSystem Shutdown/Reboot - MacOsIgor Fits, Mikhail Larin, oscd.community