TonRAT Forced Shutdown via cmd /c shutdown -s -t 0 (T1529)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to initiate an immediate system shutdown (timer set to 0 seconds). The rule monitors for this command being invoked by common execution engines such as cmd.exe or node.exe, which is often associated with disruptive activity or ransomware attempts.