Suspicious Execution of Shutdown
A Sigma rule for process creation on Windows, by frack113.
medium 1 ATT&CK technique 2 programs it names 7 everyday examples trip it
What it looks for
detection:
selection:
CommandLine|contains:
- '/r '
- '/s '
Image|endswith: '\shutdown.exe'
condition: selection
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by frack113, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
To force apps to close and to restart the local computer after a one-minute delay, with the reason Application: Maintenance (Planned) and the comment "Reconfiguring myapp.exe", type on the page for shutdown
shutdown /r /t 60 /c "Reconfiguring myapp.exe" /f /d p:4:1IdentifyTo perform a planned shutdown of a device in 10 minutes and capture the reason in the shutdown event tracker with the comment "Scheduled maintenance", type on the page for shutdown
shutdown.exe /s /t 600 /d p:0:0 /e /c "Scheduled maintenance"IdentifyTo restart the remote computer myremoteserver with the same parameters as the previous example, type on the page for shutdown
shutdown /r /m \\myremoteserver /t 60 /c "Reconfiguring myapp.exe" /f /d p:4:1Identify