System shutdown or reboot

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	System Shutdown/Reboot (T1529)
Severity	Informational

Description

System shutdown or reboot using shutdown, reboot, halt or poweroff.

Attacker's Goals

Attackers may shut down or reboot hosts to disturb access to those hosts.

Investigative actions

• Verify that this isn't IT activity.