T1529 · threatengine.sh

Home/ATT&CK Technique/System Shutdown/Reboot

ATT&CK Technique

System Shutdown/Reboot

T1529 · impact

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. reload).

They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may also use Windows API functions, such as InitializeSystemShutdownExW or ExitWindowsEx, to force a system to shut down or reboot.

Alternatively, the NtRaiseHardErroror ZwRaiseHardError Windows API functions with the ResponseOption parameter set to OptionShutdownSystem may deliver a “blue screen of death” (BSOD) to a system. In order to leverage these API functions, an adversary may need to acquire SeShutdownPrivilege (e.g., via Access Token Manipulation). In some cases, the system may not be able to boot again.

Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as Disk Structure Wipe or Inhibit System Recovery, to hasten the intended effects on system availability.

ESXiLinuxmacOSNetwork DevicesWindows

◆

Actors Using This

14

iranAgrius
russiaAwfulShred
russia_apt_sandwormCaddyWiper
russia_speaking_organized_cybercrimeDarkSide / BlackMatter
russia_aligned_destructive_operations_uncertain_sandworm_attributionDoubleZero
russia_apt_sandworm_adjacentHermeticWiper
russia_apt_sandwormNotPetya
russia_apt_sandwormOlympic Destroyer
russia_apt_sandwormPrestige ransomware
russia_apt_sandwormRansomBoggs
russiaRoarBAT
russiaSandworm Team
russia_apt_sandwormSwiftSlicer
latin_america_brazilian_organized_cybercrimeVadokrist

◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.

execution earlier

T1569 · System Services ×8.50 T1569.002 · Service Execution ×5.41

persistence earlier

T1037.003 · Network Logon Script ×14.88

privilege-escalation earlier

T1484.001 · Group Policy Modification ×12.40 T1484 · Domain or Tenant Policy Modification ×9.30

discovery earlier

T1069.002 · Domain Groups ×5.95

lateral-movement earlier

T1080 · Taint Shared Content ×4.96

impact same

T1488 · Disk Content Wipe ×14.88 T1496 · Resource Hijacking ×9.92 T1495 · Firmware Corruption ×9.15 T1499.004 · Application or System Exploitation ×8.68 T1561.002 · Disk Structure Wipe ×8.18 T1561 · Disk Wipe ×7.97 T1561.001 · Disk Content Wipe ×7.44 T1491.001 · Internal Defacement ×5.72

▸

Atomic Tests

16

Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.

command_promptelevatedwindowsShutdown System - Windows

This test shuts down a Windows system.

shutdown /s /t #{timeout}

command_promptelevatedwindowsRestart System - Windows

This test restarts a Windows system.

shutdown /r /t #{timeout}

shelevatedlinux, macosRestart System via `shutdown` - FreeBSD/macOS/Linux

This test restarts a FreeBSD/macOS/Linux system.

shutdown -r #{timeout}

shelevatedlinux, macosShutdown System via `shutdown` - FreeBSD/macOS/Linux

This test shuts down a FreeBSD/macOS/Linux system using a halt.

shutdown -h #{timeout}

shelevatedlinux, macosRestart System via `reboot` - FreeBSD/macOS/Linux

This test restarts a FreeBSD/macOS/Linux system via `reboot`.

reboot

shelevatedlinuxShutdown System via `halt` - FreeBSD/Linux

This test shuts down a FreeBSD/Linux system using `halt`.

halt -p

shelevatedlinuxReboot System via `halt` - FreeBSD

This test restarts a FreeBSD system using `halt`.

halt -r

bashelevatedlinuxReboot System via `halt` - Linux

This test restarts a Linux system using `halt`.

halt --reboot

shelevatedlinuxShutdown System via `poweroff` - FreeBSD/Linux

This test shuts down a FreeBSD/Linux system using `poweroff`.

poweroff

shelevatedlinuxReboot System via `poweroff` - FreeBSD

This test restarts a FreeBSD system using `poweroff`.

poweroff -r 3

bashelevatedlinuxReboot System via `poweroff` - Linux

This test restarts a Linux system using `poweroff`.

poweroff --reboot

command_promptelevatedwindowsLogoff System - Windows

This test performs a Windows system logoff as seen in [dcrat backdoor capabilities](https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor)

shutdown /l

command_promptwindowsESXi - Terminates VMs using pkill

In VMWARE ESXi, process names starting with vmx are associated with running VMs. An adversary can use the pkill command to kill all processes with a prefix vmx. [Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"

command_promptwindowsESXi - Avoslocker enumerates VMs and forcefully kills VMs

Avoslocker malware has inbuilt functionality to enumerate the VM instances and uses the esxcli command to forcefully power off them. [Reference](https://blogs.vmware.com/security/2022/02/avoslocker-modern-linux-ransomware-threats.html)

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"

command_promptwindowsESXi - vim-cmd Used to Power Off VMs

Adversaries may power off VMs to facilitate the deployment of ransomware payloads. [Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#power%20off%20vm)

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/power.off $i & done"

bashelevatedlinuxAbuse of Linux Magic System Request Key for Reboot

adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can forced to reboot.

echo "b" > /proc/sysrq-trigger

◈

Detection Coverage

1/6 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) 8

Analytics (MITRE CAR) none

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) none

Vuln scan (Nuclei) none

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin