CmdID

CmdID / Techniques

T1529 System Shutdown/Reboot

Adversaries may shut down/reboot systems to interrupt access to, or aid in the destruction of, those systems. MITRE ATT&CK

4 Sigma rules T1529 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first
mediumESXi VM Kill Via ESXCLINasreddine Bencherchali (Nextron Systems), Cedric Maurugeon · Linux
mediumSuspicious Execution of Shutdownfrack113 · Windows
mediumSuspicious Execution of Shutdown to Log Outfrack113 · Windows
informationalSystem Shutdown/Reboot - MacOsIgor Fits, Mikhail Larin, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Halt the system on the page for halt

Power off the system (same as poweroff) on the page for halt

halt --poweroffIdentify

Reboot the system (same as reboot) on the page for halt

halt --rebootIdentify

Halt immediately without contacting the system manager on the page for halt

halt --forceIdentify

Write the wtmp shutdown entry without halting the system on the page for halt

halt --wtmp-onlyIdentify

Set an interface to be active or inactive (this is run inside the interface command) on the page for interface

no shutdown|shutdownIdentify

Reboot the system on the page for reboot

rebootIdentify

Power off the system (same as poweroff) on the page for reboot

reboot --poweroffIdentify

Halt (terminates all processes and shuts down the CPU) the system (same as halt) on the page for reboot

reboot --haltIdentify

Reboot immediately without contacting the system manager on the page for reboot

reboot --forceIdentify

Write the wtmp shutdown entry without rebooting the system on the page for reboot

reboot --wtmp-onlyIdentify

Reboot immediately on the page for reboot

sudo rebootIdentify

And 19 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1529: a Sigma rule it trips is tagged with it, or its abuse is documented as it.