T1529Impact
System Shutdown/Reboot
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. reload). They may also include…
CVEs3
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
8 Sigma rules tagged T1529System Shutdown/RebootT15298 general rules
- Silence.EDA Detectioncriticaltest
- Cisco Denial of Servicemediumtest
- ESXi VM Kill Via ESXCLImediumtest
- Suspicious Execution of Shutdownmediumtest
- Suspicious Execution of Shutdown to Log Outmediumtest
- Potential Abuse of Linux Magic System Request Keymediumexperimental
- System Shutdown/Reboot - Linuxinformationaltest
- System Shutdown/Reboot - MacOsinformationaltest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to System Shutdown/Reboot
3 CVEs, by priority. Each link shows its badge.- CVE-2019-1817Cisco Web Security Appliance Malformed Request Denial of Service VulnerabilityCisco · Cisco Web Security Appliance (WSA)High · 8.6T1190Exploit Public-Facing ApplicationT1529System Shutdown/RebootMITRE CTID mapping of the CVE · primary impact1.8%Top 22%21.7priority
- CVE-2018-18995Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be…MITRE CTID mapping of the CVE · follow-on activity2.6%Top 14%17.1priority
- CVE-2018-15397Cisco Adaptive Security Appliance IPsec VPN Denial of Service VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) SoftwareT1190Exploit Public-Facing ApplicationT1529System Shutdown/RebootMITRE CTID mapping of the CVE · primary impact1.2%Top 32%13.6priority