System Shutdown/Reboot - Linux

Title: System Shutdown/Reboot - Linux
Status: test
Description:Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
Author: Igor Fits, oscd.community
Date: 2020-10-15
modified:2022-11-26
Tags:

• -'attack.impact'
• -'attack.t1529'

Logsource:

• product: linux
• service: auditd

Detection:
  execve:
    type: 'EXECVE'
  shutdowncmd:
    - 'shutdown'
    - 'reboot'
    - 'halt'
    - 'poweroff'
  init:
    - 'init'
    - 'telinit'
  initselection:
    - '0'
    - '6'
  condition:execve and (shutdowncmd or (init and initselection))
Falsepositives:
  -Legitimate administrative activity
Level: informational