# T1529 - System Shutdown/Reboot

## Description from ATT&CK

> Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. <code>reload</code>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.
> 
> Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.
> 
> Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)
> In some cases, the system may not be able to boot again.
> 
> Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)

[Source](https://attack.mitre.org/techniques/T1529)

## Atomic Tests

- [Atomic Test #1: Shutdown System - Windows](#atomic-test-1-shutdown-system---windows)
- [Atomic Test #2: Restart System - Windows](#atomic-test-2-restart-system---windows)
- [Atomic Test #3: Restart System via `shutdown` - FreeBSD/macOS/Linux](#atomic-test-3-restart-system-via-shutdown---freebsdmacoslinux)
- [Atomic Test #4: Shutdown System via `shutdown` - FreeBSD/macOS/Linux](#atomic-test-4-shutdown-system-via-shutdown---freebsdmacoslinux)
- [Atomic Test #5: Restart System via `reboot` - FreeBSD/macOS/Linux](#atomic-test-5-restart-system-via-reboot---freebsdmacoslinux)
- [Atomic Test #6: Shutdown System via `halt` - FreeBSD/Linux](#atomic-test-6-shutdown-system-via-halt---freebsdlinux)
- [Atomic Test #7: Reboot System via `halt` - FreeBSD](#atomic-test-7-reboot-system-via-halt---freebsd)
- [Atomic Test #8: Reboot System via `halt` - Linux](#atomic-test-8-reboot-system-via-halt---linux)
- [Atomic Test #9: Shutdown System via `poweroff` - FreeBSD/Linux](#atomic-test-9-shutdown-system-via-poweroff---freebsdlinux)
- [Atomic Test #10: Reboot System via `poweroff` - FreeBSD](#atomic-test-10-reboot-system-via-poweroff---freebsd)
- [Atomic Test #11: Reboot System via `poweroff` - Linux](#atomic-test-11-reboot-system-via-poweroff---linux)
- [Atomic Test #12: Logoff System - Windows](#atomic-test-12-logoff-system---windows)
- [Atomic Test #13: ESXi - Terminates VMs using pkill](#atomic-test-13-esxi---terminates-vms-using-pkill)
- [Atomic Test #14: ESXi - Avoslocker enumerates VMs and forcefully kills VMs](#atomic-test-14-esxi---avoslocker-enumerates-vms-and-forcefully-kills-vms)
- [Atomic Test #15: ESXi - vim-cmd Used to Power Off VMs](#atomic-test-15-esxi---vim-cmd-used-to-power-off-vms)
- [Atomic Test #16: Abuse of Linux Magic System Request Key for Reboot](#atomic-test-16-abuse-of-linux-magic-system-request-key-for-reboot)

### Atomic Test #1: Shutdown System - Windows

This test shuts down a Windows system.

**Supported Platforms:** Windows

**auto_generated_guid:** `ad254fa8-45c0-403b-8c77-e00b3d3e7a64`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| timeout | Timeout period before shutdown (seconds) | integer | 1|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
shutdown /s /t #{timeout}
```

### Atomic Test #2: Restart System - Windows

This test restarts a Windows system.

**Supported Platforms:** Windows

**auto_generated_guid:** `f4648f0d-bf78-483c-bafc-3ec99cd1c302`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| timeout | Timeout period before restart (seconds) | integer | 1|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
shutdown /r /t #{timeout}
```

### Atomic Test #3: Restart System via `shutdown` - FreeBSD/macOS/Linux

This test restarts a FreeBSD/macOS/Linux system.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `6326dbc4-444b-4c04-88f4-27e94d0327cb`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| timeout | Time to restart (can be minutes or specific time) | string | now|

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
shutdown -r #{timeout}
```

### Atomic Test #4: Shutdown System via `shutdown` - FreeBSD/macOS/Linux

This test shuts down a FreeBSD/macOS/Linux system using a halt.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `4963a81e-a3ad-4f02-adda-812343b351de`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| timeout | Time to shutdown (can be minutes or specific time) | string | now|

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
shutdown -h #{timeout}
```

### Atomic Test #5: Restart System via `reboot` - FreeBSD/macOS/Linux

This test restarts a FreeBSD/macOS/Linux system via `reboot`.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `47d0b042-a918-40ab-8cf9-150ffe919027`

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
reboot
```

### Atomic Test #6: Shutdown System via `halt` - FreeBSD/Linux

This test shuts down a FreeBSD/Linux system using `halt`.

**Supported Platforms:** Linux

**auto_generated_guid:** `918f70ab-e1ef-49ff-bc57-b27021df84dd`

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
halt -p
```

### Atomic Test #7: Reboot System via `halt` - FreeBSD

This test restarts a FreeBSD system using `halt`.

**Supported Platforms:** Linux

**auto_generated_guid:** `7b1cee42-320f-4890-b056-d65c8b884ba5`

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
halt -r
```

### Atomic Test #8: Reboot System via `halt` - Linux

This test restarts a Linux system using `halt`.

**Supported Platforms:** Linux

**auto_g