Linux System Shutdown or Reboot Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•31

This rule detects attempts to shut down or reboot a Linux system using common commands like 'shutdown', 'reboot', 'halt', 'poweroff', or by using 'init' or 'telinit' with specific runlevel arguments (0 for halt/shutdown, 6 for reboot). Adversaries may use these methods to disrupt system availability or aid in the destruction of data.