T1529 Remote System Shutdown via MSRPC MS-RRP InitiateSystemShutdown over SMB winreg Pipe

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects remote system shutdown attempts initiated via the MSRPC winreg named pipe over SMB. This behavior is indicative of an attacker attempting to shut down or reboot a target system remotely to interrupt availability, often as a prelude to or consequence of destructive actions.