Suspicious Execution of Shutdown to Log Out
Detects the use of the 'shutdown.exe' command-line tool with the '/l' argument, which is used to log off the current user. This activity is considered rare and potentially suspicious as it can be used by adversaries to disrupt user sessions or as part of system manipulation tactics.
Sigma
