TonRAT Post-Compromise Forced Shutdown via cmd /c shutdown -s -t 0

Ethan Andrews@eandrews

•updated Jun 26, 2026•1•0•3

Detects the execution of forced system shutdown commands (shutdown -s -t 0) initiated via cmd.exe or PowerShell. This behavior is often observed in post-compromise scenarios, including the TonRAT campaign, to disrupt system availability.