Forced shutdown or restart requested with no delay

Siemphony@siemphonylowT1529unverified

Matches shutdown.exe run with a shutdown or restart action and with either the force flag or a zero timeout, which is the destructive shape AN1538 describes: an operator-scheduled reboot normally leaves a grace period so users can save work, while an adversary ending a system takes it now. Flags are matched with windash because shutdown.exe accepts /f, -f and the Unicode dash forms interchangeably. The nearest MITRE knob is CommandLineMatch, but DET0559 attaches that one to the Linux analytic AN1539, not to AN1538; the flag combinations here are authored either way. AN1538's own two knobs are not expressible in this Sigma subset — "user not in Helpdesk group" needs a group lookup and "unexpected during business hours" needs a time comparison, and without them the rule cannot separate an adversary from an admin, which is why the level is low rather than the severity of the outcome. The brief's other Windows source, EventID 1074, is not used: it is written by USER32 to the System channel, but the brief maps it onto product windows / service security, and a rule on the Security service would parse, render and match nothing. Blind spots that follow from keying on the process: PowerShell Restart-Computer and Stop-Computer, and the API routes ATT&CK names (InitiateSystemShutdownExW, ExitWindowsEx, NtRaiseHardError for a forced BSOD), all shut the host down without ever creating a shutdown.exe process. The rule is written in the Sysmon EventID 1 vocabulary the brief names; if Security 4688 feeds this category instead, CommandLine is populated only with both Audit Process Creation and the separate Include command line in process creation events policy enabled, and the field is empty otherwise. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0559, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\shutdown.exe" and (ProcessCommandLine contains "-r" or ProcessCommandLine contains "/r" or ProcessCommandLine contains "–r" or ProcessCommandLine contains "—r" or ProcessCommandLine contains "―r" or ProcessCommandLine contains "-s" or ProcessCommandLine contains "/s" or ProcessCommandLine contains "–s" or ProcessCommandLine contains "—s" or ProcessCommandLine contains "―s")) and (ProcessCommandLine contains "-f" or ProcessCommandLine contains "/f" or ProcessCommandLine contains "–f" or ProcessCommandLine contains "—f" or ProcessCommandLine contains "―f" or ProcessCommandLine contains "-t 0" or ProcessCommandLine contains "/t 0" or ProcessCommandLine contains "–t 0" or ProcessCommandLine contains "—t 0" or ProcessCommandLine contains "―t 0"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\shutdown.exe" AND (CommandLine="*-r*" OR CommandLine="*/r*" OR CommandLine="*–r*" OR CommandLine="*—r*" OR CommandLine="*―r*" OR CommandLine="*-s*" OR CommandLine="*/s*" OR CommandLine="*–s*" OR CommandLine="*—s*" OR CommandLine="*―s*")) AND (CommandLine="*-f*" OR CommandLine="*/f*" OR CommandLine="*–f*" OR CommandLine="*—f*" OR CommandLine="*―f*" OR CommandLine="*-t 0*" OR CommandLine="*/t 0*" OR CommandLine="*–t 0*" OR CommandLine="*—t 0*" OR CommandLine="*―t 0*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\shutdown.exe" AND (TO_LOWER(process.command_line) LIKE "*-r*" OR TO_LOWER(process.command_line) LIKE "*/r*" OR TO_LOWER(process.command_line) LIKE "*–r*" OR TO_LOWER(process.command_line) LIKE "*—r*" OR TO_LOWER(process.command_line) LIKE "*―r*" OR TO_LOWER(process.command_line) LIKE "*-s*" OR TO_LOWER(process.command_line) LIKE "*/s*" OR TO_LOWER(process.command_line) LIKE "*–s*" OR TO_LOWER(process.command_line) LIKE "*—s*" OR TO_LOWER(process.command_line) LIKE "*―s*")) AND (TO_LOWER(process.command_line) LIKE "*-f*" OR TO_LOWER(process.command_line) LIKE "*/f*" OR TO_LOWER(process.command_line) LIKE "*–f*" OR TO_LOWER(process.command_line) LIKE "*—f*" OR TO_LOWER(process.command_line) LIKE "*―f*" OR TO_LOWER(process.command_line) LIKE "*-t 0*" OR TO_LOWER(process.command_line) LIKE "*/t 0*" OR TO_LOWER(process.command_line) LIKE "*–t 0*" OR TO_LOWER(process.command_line) LIKE "*—t 0*" OR TO_LOWER(process.command_line) LIKE "*―t 0*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\shutdown\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-r|/r|–r|—r|―r|-s|/s|–s|—s|―s)</field>    <field name="CommandLine" type="pcre2">(?i)(-f|/f|–f|—f|―f|-t 0|/t 0|–t 0|—t 0|―t 0)</field>    <description>Forced shutdown or restart requested with no delay</description>    <mitre>      <id>T1529</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: impact_destruction
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1ac179b6-b5e3-4e05-aa1a-1396c41b653f

ATT&CKT1529

T1529System Shutdown/Reboot

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonimpact destruction

impact destructionAI draft — unreviewed

01 · What this rule detects

A Windows host being shut down or restarted immediately and without warning. MITRE's AN1538 describes the destructive use of system shutdown as an impact action. The rule keys on the shape rather than the act: an operator-scheduled reboot normally leaves a grace period so users can save work, whereas an adversary ending a system takes it now. So the observable is shutdown.exe carrying both an action flag and either the force flag or a zero timeout.

02 · Telemetry you need

Windows process creation with the command line intact. The rule is written in the Sysmon EventID 1 vocabulary the brief names (Image, CommandLine). If Security 4688 feeds the process_creation category instead, CommandLine is populated only when both Audit Process Creation and the separate Include command line in process creation events policy are enabled; without the second one the field is empty and every selection fails silently. The brief's other Windows source, EventID 1074, is not used: USER32 writes it to the System channel, but the brief maps it onto product windows / service security, and a rule on the Security service would parse, render in four backends and match nothing.

03 · How the logic works

Three blocks, all ANDed. selection_binary matches Image|endswith: '\shutdown.exe'. selection_action matches CommandLine|contains|windash on /r and /s — restart and shutdown. selection_force matches the same way on /f and /t 0. The windash modifier is what makes this hold up in practice: shutdown.exe accepts /f, -f and the Unicode dash forms interchangeably, and without the modifier an adversary typing a hyphen walks straight past a slash-only rule. Attribution matters here. The nearest MITRE knob is CommandLineMatch, but DET0559 attaches it to the Linux analytic AN1539, not to AN1538 — the flag combinations above are the pipeline's own either way. AN1538's own two knobs, UserContext and TimeWindow, are not expressible in this Sigma subset: "user not in the Helpdesk group" needs a group lookup and "unexpected during business hours" needs a time comparison. Without them the rule cannot separate an adversary from an administrator, which is precisely why the level is low rather than the severity of the outcome. Blind spots follow from keying on the process. PowerShell Restart-Computer and Stop-Computer, and the API routes ATT&CK names — InitiateSystemShutdownExW, ExitWindowsEx, NtRaiseHardError for a forced bugcheck — all end the host without ever creating a shutdown.exe process.

04 · Common false positives

Loudly, in waves. Patch and configuration management closing a maintenance window is the highest-volume match by a wide margin: the SCCM client, Intune, WSUS scripts, Ansible win_reboot and Puppet or Chef reboot handlers all finish a run with a forced zero-delay restart, and they do it fleet-wide on patch night. Helpdesk staff restart hung machines by hand and use /f because an application will not close. Imaging and provisioning sequences — MDT, SCCM OSD, sysprep wrappers, Packer and Vagrant builds — force restarts between phases. Driver and agent installers do the same on completion, and lab, kiosk or classroom images often carry a scheduled nightly forced reboot.

05 · Detection maturity

tier_1: Lowest tier until run against real data. This is machine-derived from a MITRE scaffold and has never been executed against a log line: the windash behaviour, the '/t 0' spacing and the noise volume are all untested assumptions. Search history first and measure the patch-night baseline before treating any output as an alert.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Suppress by context, not by flag — the flags are the whole rule. Exclude the management agents by parent process, exclude your build and imaging subnets by host, and exclude the scheduled-task account on kiosk images. What remains is worth reading. Then rebuild MITRE's two knobs outside Sigma: enrich with group membership to approximate UserContext, and gate on your maintenance calendar to approximate TimeWindow. A forced shutdown from a workstation account outside a window, on a host that is not mid-build, is the actual signal — and it is far more interesting when it lands beside encryption or wiping activity.

Declared by the author

Patch and configuration management closing a maintenance window — the SCCM client, Intune, WSUS scripts, Ansible win_reboot and Puppet or Chef reboot handlers all end a run with a forced zero-delay restart; on a managed estate this is the highest-volume match by a wide margin and it arrives in waves on patch night.
Helpdesk and administrators restarting an unresponsive or newly configured machine, typed by hand or pushed remotely, where the force flag is used precisely because an application is hung and will not close on its own.
Imaging and provisioning task sequences — MDT and SCCM OSD steps, sysprep wrappers, Packer and Vagrant template builds — that force an immediate restart between phases of an unattended build.
Driver, agent and suite installers or uninstallers that call shutdown.exe with the force flag on completion, and lab, kiosk or classroom images carrying a scheduled task that forces a nightly restart.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1529, evaluated against their process_creation events.

Share this rule

/u/siemphony/1ac179b6-b5e3-4e05-aa1a-1396c41b653f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Forced shutdown or restart requested with no delay

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it