type: attack-pattern
spec_version: 2.1
id: attack-pattern--ff73aa03-0090-4464-83ac-f89e233c02bc
created: 2019-10-04T20:42:28.541Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1529
external_id: T1529
source_name: Talos Nyetya June 2017
description: Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
url: https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html
source_name: alert_TA18_106A
description: CISA. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved February 14, 2022.
url: https://www.cisa.gov/uscert/ncas/alerts/TA18-106A
source_name: NotMe-BSOD
description: lzcapp. (n.d.). Retrieved September 22, 2025.
url: https://github.com/lzcapp/NotMe-BSOD
source_name: Talos Olympic Destroyer 2018
description: Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
url: https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
source_name: Microsoft Shutdown Oct 2017
description: Microsoft. (2017, October 15). Shutdown. Retrieved October 4, 2019.
url: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
source_name: NtRaiseHardError
description: NtDoc. (n.d.). NtRaiseHardError - NtDoc. Retrieved September 22, 2025.
url: https://ntdoc.m417z.com/ntraiseharderror
source_name: Unit42 Agrius 2023
description: Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.
url: https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
source_name: SonicWall
description: SecurityNews. (2024, July 12). Disarming DarkGate: A Deep Dive into Thwarting the Latest DarkGate Variant. Retrieved September 22, 2025.
url: https://www.sonicwall.com/blog/disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant
source_name: CrowdStrike Blog
description: William Thomas, Adrian Liviu Arsene, Farid Hendi. (2022, February 25). CrowdStrike Falcon® Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved September 22, 2025.
url: https://www.crowdstrike.com/en-us/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:40.145Z
name: System Shutdown/Reboot
description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.

Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.

Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)
 In some cases, the system may not be able to boot again. 

Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: impact
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Austin Clark, @c2defense
Hubert Mank
Janantha Marasinghe
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: ESXi
Linux
macOS
Network Devices
Windows
x_mitre_version: 1.5
x_mitre_impact_type: Availability