Detectioninformationaltest

System Shutdown/Reboot - MacOs

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Igor Fits, Mikhail Larin, oscd.communityCreated Mon Oct 19Updated Sat Nov 2640b1fbe2-18ea-4ee7-be47-0294285811demacos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith:
            - '/shutdown'
            - '/reboot'
            - '/halt'
    condition: selection

False Positives

Legitimate administrative activity

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

40b1fbe2-18ea-4ee7-be47-0294285811de

Status

test

Level

informational

Type

Detection

Created

Mon Oct 19

Modified

Sat Nov 26

Author

Path

rules/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml

Raw Tags

attack.impactattack.t1529