All Detections

Windows System Shutdown/Reboot (Normalized Process Events)

Azure Sentinel@AzureSentinel
updated Jun 17, 20251023

'This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529)'

Microsoft Sentinel (KQL)