T1529 — System Shutdown/Reboot

# T1529 - System Shutdown/Reboot

## SOC Recommendation
Investigate System Shutdown/Reboot activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
ClarotyEvent
| where EventOriginalType has 'Asset Down' or EventType has 'Asset Down'
| project TimeGenerated, DstIpAddr
| extend IPCustomEntity = DstIpAddr
```
```kql
ClarotyEvent
| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'
| where EventSeverity == '5'
| project TimeGenerated, DstIpAddr
| extend IPCustomEntity = DstIpAddr
```
```kql
let threshold = 5;
OCILogs
| where data_eventName_s =~ 'TerminateInstance'
| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
| where count_ >= threshold
| extend IPCustomEntity = SrcIpAddr
```

## Escalation Criteria
- System Shutdown/Reboot activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1529.json
• /api/recommendations/T1529.json
• /api/d3fend/T1529.json
• /api/mappings/T1529.json
• /api/confluence/T1529.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1529.json

Response:

{
  "technique_id": "T1529",
  "name": "System Shutdown/Reboot",
  "priority": "medium",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Impact"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Network Devices",
    "Windows"
  ],
  "summary": "Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. <code>reload</code>)...",
  "soc_recommendation": "Investigate System Shutdown/Reboot activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NTA",
      "name": "Network Traffic Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Network Traffic Analysis indicators relevant to this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.",
      "Check whether activity aligns with a planned change or approved business process.",
      "Identify all affected users/devices/resources over the prior 24 hours.",
      "Determine whether this is isolated or part of a broader campaign.",
      "Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.",
      "Elevate severity if privileged identities, critical systems, or repeated activity is observed.",
      "Capture all evidence (query results, entities, timeline) in the incident record.",
      "Route to the appropriate response playbook and customer escalation path."
    ],
    "generic": [
      "Confirm whether the observed system shutdown/reboot activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Claroty - Asset Down\" -- Triggers asset is down.'"
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain impacted identities/endpoints/sessions based on obse",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Contain impacted identities/endpoints/sessions based on observed behavior."
    },
    {
      "name": "Block malicious indicators (IP, URL, domain, hash) where ava",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Block malicious indicators (IP, URL, domain, hash) where available."
    },
    {
      "name": "Complete blast radius analysis across related logs and entit",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Complete blast radius analysis across related logs and entities."
    },
    {
      "name": "Notify stakeholders according to incident priority and custo",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Notify stakeholders according to incident priority and customer SLA."
    },
    {
      "name": "Remove persistence or unauthorized access paths identified d",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Remove persistence or unauthorized access paths identified during investigation."
    },
    {
      "name": "Capture lessons learned and update rule tuning/watchlists.",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "fd6e3416-0421-4166-adb9-186e555a7008 — Claroty - Asset Down",
        "description": "Triggers asset is down.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "ClarotyEvent\n| where EventOriginalType has 'Asset Down' or EventType has 'Asset Down'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr"
      },
      {
        "name": "9a8b4321-e2be-449b-8227-a78227441b2a — Claroty - Critical baseline deviation",
        "description": "Detects Claroty events where EventOriginalType or EventType indicates a Baseline Deviation and EventSeverity is 5, which represents a critical deviation from baseline that may indicate disruptive or unauthorized activity. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "ClarotyEvent\n| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'\n| where EventSeverity == '5'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr"
      },
      {
        "name": "252e651d-d825-480c-bdeb-8b239354577d — OCI - Multiple instances terminated",
        "description": "Detects when multiple instances were terminated.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let threshold = 5;\nOCILogs\n| where data_eventName_s =~ 'TerminateInstance'\n| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)\n| where count_ >= threshold\n| extend IPCustomEntity = SrcIpAddr"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "83a1931d-8136-46fc-b7b9-2db4f639e014 — Azure Kubernetes Services (AKS) Kubernetes Pods Deleted",
        "description": "(KUERY) Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kubernetes pod to disrupt the normal behavior of the environment. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "data_stream.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE\" and\nevent.outcome:(Success or success)"
      },
      {
        "name": "bb4fe8d2-7ae2-475c-8b5d-55b449e4264f — Azure Resource Group Deleted",
        "description": "(KUERY) Identifies the deletion of a resource group in Azure, which includes all resources within the group. Deletion is permanent and irreversible. An adversary may delete a resource group in an attempt to evade defenses or intentionally destroy data. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "data_stream.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE\" and event.outcome:(Success or success)"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "System Shutdown/Reboot activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners",
    "Security testing or red-team exercise — Source identity/host matches approved test plan"
  ],
  "confluence": {
    "title": "T1529 - System Shutdown/Reboot Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}