T1529 System Shutdown/Reboot Abuse via shutdown, wmic, PowerShell, rundll32

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.