MITRE ATT&CKtechnique

T1529 System Shutdown/Reboot

Published 2019-10-04 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Impact
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.5
Created
2019-10-04

Description

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. reload). They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot. Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system. In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via Access Token Manipulation). In some cases, the system may not be able to boot again. Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as Disk Structure Wipe or Inhibit System Recovery, to hasten the intended effects on system availability.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (32)

  • S9051 The Gentlemen Ransomware software (malware)
  • S9042 CanisterWorm software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9038 DynoWiper software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1207 XLoader software (malware)
  • S1178 ShrinkLocker software (malware)
  • S1167 AcidPour software (malware)
  • S1160 Latrodectus software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • S1133 Apostle software (malware)
  • S1135 MultiLayer Wiper software (malware)
  • S1136 BFG Agonizer software (malware)
  • S1125 AcidRain software (malware)
  • S1111 DarkGate software (malware)
  • S1070 Black Basta software (malware)
  • S1053 AvosLocker software (malware)
  • S1033 DCSrv software (malware)
  • S0697 HermeticWiper software (malware)
  • S0689 WhisperGate software (malware)
  • S0582 LookBack software (malware)
  • S0607 KillDisk software (malware)
  • S0449 Maze software (malware)
  • S0372 LockerGoga software (malware)
  • S0368 NotPetya software (malware)
  • S0365 Olympic Destroyer software (malware)
  • G0082 APT38 group
  • S0332 Remcos software (tool)
  • G0067 APT37 group
Show all 32 ›

References