System Shutdown/Reboot - MacOs
A Sigma rule for process creation on macOS, by Igor Fits, Mikhail Larin, oscd.community.
informational 1 ATT&CK technique 3 programs it names 23 everyday examples trip it
What it looks for
detection:
selection:
Image|endswith:
- '/shutdown'
- '/reboot'
- '/halt'
condition: selection
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Igor Fits, Mikhail Larin, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Write the wtmp shutdown entry without halting the system on the page for halt
halt --wtmp-onlyIdentifySet an interface to be active or inactive (this is run inside the interface command) on the page for interface
no shutdown|shutdownIdentifyHalt (terminates all processes and shuts down the CPU) the system (same as halt) on the page for reboot
reboot --haltIdentifyReboot immediately without contacting the system manager on the page for reboot
reboot --forceIdentifyWrite the wtmp shutdown entry without rebooting the system on the page for reboot
reboot --wtmp-onlyIdentifyAnd 11 more examples on CmdID’s program pages.