All Detections

Windows System Shutdown/Reboot(Sysmon)

Azure Sentinel@AzureSentinel
updated Jun 17, 20252026

'This detection uses Sysmon telemetry to detect System Shutdown/Reboot (MITRE Technique: T1529)'

Microsoft Sentinel (KQL)