tfMITRE ATT&CK technique

System Shutdown/Reboot T1529

Tactic: Impact
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.5
Created: 04 October 2019
Last modified: 12 May 2026
Contributors: Austin Clark, @c2defense; Hubert Mank; Janantha Marasinghe

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. reload).[1][2] They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 13%

Tools & malware87th percentile · 87% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

System Shutdown/Reboot MITRE reference T1529

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has manually turned off and encrypted virtual machines.1

created 2025-10-151 reference

APT38G0082 ↗

Has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.1

created 2019-01-291 referenceaka NICKEL GLADSTONE

APT37G0067 ↗

Has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.1

created 2018-04-181 referenceaka InkySquid

Lazarus GroupG0032 ↗

Has rebooted systems after destroying files and wiping the MBR on infected systems.1

created 2017-05-311 referenceaka Labyrinth Chollima

All 4 groups for this technique

26 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

CanisterWormS9042 ↗

Has forced the target system to reboot after file deletion.1

created 2026-07-24MALWAREcarried by 1 group

DynoWiperS9038 ↗

Has used the Microsoft Windows native ExitWindowsEx() function to log off the interactive user and shutdown the system.1

created 2026-04-22MALWARE

QilinS1242 ↗

Can initiate a reboot of the backup server to hinder recovery.1

created 2025-09-26MALWAREcarried by 2 groups

XLoaderS1207 ↗

Can initiate a system reboot or shutdown.1

created 2025-03-11MALWARE

ShrinkLockerS1178 ↗

Can restart the victim system if it encounters an error during execution, and will forcibly shutdown the system following encryption to lock out victim users.1

created 2024-12-07MALWARE

AcidPourS1167 ↗

Includes functionality to reboot the victim system following wiping actions, similar to AcidRain.1

created 2024-11-25MALWAREcarried by 1 group

All 26 software entries for this technique · 6 newest in this preview

Offense vs defense T1529

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 8

first rule: 2019 Q3 · 1 of 1 campaigns plotted

System Shutdown/Reboot detection strategy DET0559

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events

Enterprise

5 platforms

AN1538 · Windows

Correlate process execution of shutdown/reboot commands (e.g., shutdown.exe, restart-computer) with host status change logs (Event IDs 1074, 6006) and absence of related administrative context (e.g., user not in Helpdesk group).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	WinEventLog:Security	EventCode=1074
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Defines if user has appropriate privileges to initiate shutdown/reboot.
TimeWindow	Unexpected shutdowns during business hours may warrant increased scrutiny.

AN1539 · Linux

Detect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	linux:syslog	system is powering down
Command ExecutionDC0064	auditd:SYSCALL	execve=/sbin/shutdown or /sbin/reboot

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLineMatch	Supports multiple binary names or symlinked utilities.
UserContext	Privileged user (e.g., root or via sudo) context matching expected roles.

AN1540 · macOS

Identify use of 'shutdown', 'reboot', or 'osascript' system shutdown invocations within unified logs and track unexpected shutdown sequences initiated by GUI or script. Cross-reference with user activity or absence thereof.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	macos:unifiedlog	System shutdown or reboot requested
Process CreationDC0032	macos:unifiedlog	shutdown -h now or reboot

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LaunchMechanism	Scripted vs interactive shutdowns.
LogGranularity	May vary depending on macOS version and unified log verbosity.

AN1541 · ESXi

Detect commands such as 'esxcli system shutdown' or 'vim-cmd vmsvc/power.shutdown' executed outside of maintenance windows or via unusual users. Reboot logs in hostd.log and shell logs should be correlated.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	esxi:hostd	Powering off or restarting host
Command ExecutionDC0064	esxi:shell	esxcli system shutdown or reboot invoked

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AccountRole	Administrative account context validation.
MaintenanceWindow	Expected times for reboot/shutdown behavior.

AN1542 · Network Devices

Monitor CLI 'reload' commands issued without scheduled maintenance, and correlate to TACACS+/AAA logs for privilege validation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	networkdevice:syslog	System reboot scheduled or performed
Command ExecutionDC0064	networkdevice:syslog	reload command issued

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PrivilegeLevel	TACACS+/AAA role thresholds for command execution.
ChangeTicketCorrelation	Track change control windows or ITSM integration.

Tests16Executorssh 7 · cmd 6 · bash 3Need elevation13 of 16Have prerequisites3Have cleanup0Platformswindows, linux, macos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Shutdown System - Windows windows cmd Required — —

This test shuts down a Windows system.

Input arguments

Name	Type	Default	Description
timeout	integer	1	Timeout period before shutdown (seconds)

Attack command

shutdown /s /t #{timeout}

GUID667b454e-9aed-40c1-bc94-9ee8187207ff

02 Restart System - Windows windows cmd Required — —

This test restarts a Windows system.

Input arguments

Name	Type	Default	Description
timeout	integer	1	Timeout period before restart (seconds)

Attack command

shutdown /r /t #{timeout}

GUID1b907e96-c277-4391-a872-5803d5143367

03 Restart System via `shutdown` - FreeBSD/macOS/Linux linux, macos sh Required — —

This test restarts a FreeBSD/macOS/Linux system.

Input arguments

Name	Type	Default	Description
timeout	string	now	Time to restart (can be minutes or specific time)

Attack command

shutdown -r #{timeout}

GUID64b29da2-2075-4bd9-b52d-dc32ca35aded

04 Shutdown System via `shutdown` - FreeBSD/macOS/Linux linux, macos sh Required — —

This test shuts down a FreeBSD/macOS/Linux system using a halt.

Input arguments

Name	Type	Default	Description
timeout	string	now	Time to shutdown (can be minutes or specific time)

Attack command

shutdown -h #{timeout}

GUID32ff87ff-133e-48f6-86fb-7c51d45308d3

05 Restart System via `reboot` - FreeBSD/macOS/Linux linux, macos sh Required — —

This test restarts a FreeBSD/macOS/Linux system via reboot.

Attack command

reboot

GUIDd339bfc0-f57f-440e-9e00-522f3243324b

06 Shutdown System via `halt` - FreeBSD/Linux linux sh Required — —

This test shuts down a FreeBSD/Linux system using halt.

Attack command

halt -p

GUID1975a290-b370-4e8f-a11e-c2659250b068

07 Reboot System via `halt` - FreeBSD linux sh Required — —

This test restarts a FreeBSD system using halt.

Attack command

halt -r

GUID055f0808-85c4-452e-8470-baa98c1a77f5

08 Reboot System via `halt` - Linux linux bash Required — —

This test restarts a Linux system using halt.

Attack command

halt --reboot

GUID33198c2d-08d1-4d04-beb5-e5be66925488

09 Shutdown System via `poweroff` - FreeBSD/Linux linux sh Required — —

This test shuts down a FreeBSD/Linux system using poweroff.

Attack command

poweroff

GUID641e96a8-9fdb-4465-a7a5-b7aa424ed06e

10 Reboot System via `poweroff` - FreeBSD linux sh Required — —

This test restarts a FreeBSD system using poweroff.

Attack command

poweroff -r 3

GUID9d7cae8f-ea93-4564-8a9d-b2ef7b0ecea8

11 Reboot System via `poweroff` - Linux linux bash Required — —

This test restarts a Linux system using poweroff.

Attack command

poweroff --reboot

GUIDf6db0f87-3c32-4edd-a1ee-9f00dbd468c8

12 Logoff System - Windows windows cmd Required — —

This test performs a Windows system logoff as seen in dcrat backdoor capabilities

Attack command

shutdown /l

GUIDdb1862f2-59ec-44eb-9a02-4c5d13054f22

13 ESXi - Terminates VMs using pkill windows cmd — 1 —

In VMWARE ESXi, process names starting with vmx are associated with running VMs. An adversary can use the pkill command to kill all processes with a prefix vmx. Reference

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name of the ESXi Server
vm_pass	string	pass	Specify the privilege user password on ESXi Server
vm_user	string	root	Specify the privilege user account on ESXi Server
cli_script	path	PathToAtomicsFolder\T1529\src\esx_pkill.txt	Path to text with commands
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to plink

Attack command

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"

Prerequisite

Check if plink is available.

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUIDd4e95af1-51f8-4143-b1c3-540a342f7c17

14 ESXi - Avoslocker enumerates VMs and forcefully kills VMs windows cmd — 1 —

Avoslocker malware has inbuilt functionality to enumerate the VM instances and uses the esxcli command to forcefully power off them. Reference

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name of the ESXi Server
vm_pass	string	pass	Specify the privilege user password on ESXi Server
vm_user	string	root	Specify the privilege user account on ESXi Server
cli_script	path	PathToAtomicsFolder\T1529\src\esx_avoslocker_kill_vm.txt	Path to text with commands
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to plink

Attack command

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"

Prerequisite

Check if plink is available.

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUID376e31b7-c5f0-45e9-9d41-e66856f25b6a

15 ESXi - vim-cmd Used to Power Off VMs windows cmd — 1 —

Adversaries may power off VMs to facilitate the deployment of ransomware payloads. Reference

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name or IP of the ESXi server.
vm_pass	string	password	Specify the privileged user's password.
vm_user	string	root	Specify the privilege user account on the ESXi server.
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to Plink

Attack command

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "for i in `vim-cmd vmsvc/getallvms | awk 'NR>1 {print $1}'`; do vim-cmd vmsvc/power.off $i & done"

Prerequisite

Check if we have plink

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUID51b9bdc9-d5a1-4cc8-af5d-cd22b6059bd6

16 Abuse of Linux Magic System Request Key for Reboot linux bash Required — —

adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can forced to reboot.

Attack command

echo "b" > /proc/sysrq-trigger

GUIDa52b2bcf-b205-40ac-91da-2cafbfa8a144

Tests from Atomic Red Team (MIT licence) · technique definition

System Shutdown/Reboot detections T1529

16 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs