Remote System Shutdown Command via SMB

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects attempts to remotely shut down a system using the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic destined for port 445 (SMB). This activity can be indicative of an attacker attempting to disrupt services or systems.