← Back to SOC feed Coverage →

Windows System Shutdown/Reboot (Normalized Process Events)

kql MEDIUM Azure-Sentinel
T1529
imProcessCreate
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-04-22T09:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use system shutdown or reboot events to evade detection or persist across reboots. SOC teams should proactively hunt for this behavior to identify potential lateral movement or persistence tactics in their Azure Sentinel environment.

KQL Query

let timeframe = 1d;
imProcessCreate
| where Process has "shutdown.exe" 
| extend HostCustomEntity = Dvc, AccountCustomEntity = User

Analytic Rule Definition

id: 614a59c5-2dae-4430-bb16-951a28a5f05f
name: Windows System Shutdown/Reboot (Normalized Process Events)
description: |
  'This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529)'

requiredDataConnectors: []

tactics:
  - Impact
relevantTechniques:
  - T1529

query: |
  let timeframe = 1d;
  imProcessCreate
  | where Process has "shutdown.exe" 
  | extend HostCustomEntity = Dvc, AccountCustomEntity = User

entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity

Required Data Sources

Sentinel TableNotes
imProcessCreateEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/ASimProcess/imProcess_Windows System Shutdown-Reboot(T1529).yaml