AN1538
Analytic 1538
Windows
Correlate process execution of shutdown/reboot commands (e.g., shutdown.exe, restart-computer) with host status change logs (Event IDs 1074, 6006) and absence of related administrative context (e.g., user not in Helpdesk group).
WinEventLog:Security
EventCode=1074
WinEventLog:Sysmon
EventCode=1
[UserContext]
Defines if user has appropriate privileges to initiate shutdown/reboot.
[TimeWindow]
Unexpected shutdowns during business hours may warrant increased scrutiny.
AN1539
Analytic 1539
Linux
Detect 'shutdown', 'reboot', or 'systemctl poweroff' executions with auditd/syslog and absence of scheduled maintenance windows or approved user context.
auditd:SYSCALL
execve=/sbin/shutdown or /sbin/reboot
linux:syslog
system is powering down
[CommandLineMatch]
Supports multiple binary names or symlinked utilities.
[UserContext]
Privileged user (e.g., root or via sudo) context matching expected roles.
AN1540
Analytic 1540
macOS
Identify use of 'shutdown', 'reboot', or 'osascript' system shutdown invocations within unified logs and track unexpected shutdown sequences initiated by GUI or script. Cross-reference with user activity or absence thereof.
macos:unifiedlog
shutdown -h now or reboot
macos:unifiedlog
System shutdown or reboot requested
[LaunchMechanism]
Scripted vs interactive shutdowns.
[LogGranularity]
May vary depending on macOS version and unified log verbosity.
AN1541
Analytic 1541
ESXi
Detect commands such as 'esxcli system shutdown' or 'vim-cmd vmsvc/power.shutdown' executed outside of maintenance windows or via unusual users. Reboot logs in hostd.log and shell logs should be correlated.
esxi:hostd
Powering off or restarting host
esxi:shell
esxcli system shutdown or reboot invoked
[AccountRole]
Administrative account context validation.
[MaintenanceWindow]
Expected times for reboot/shutdown behavior.
AN1542
Analytic 1542
Network Devices
Monitor CLI 'reload' commands issued without scheduled maintenance, and correlate to TACACS+/AAA logs for privilege validation.
networkdevice:syslog
reload command issued
networkdevice:syslog
System reboot scheduled or performed
[PrivilegeLevel]
TACACS+/AAA role thresholds for command execution.
[ChangeTicketCorrelation]
Track change control windows or ITSM integration.