H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

System Shutdown/Reboot

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload ).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023) In some cases, the system may not be able to boot again. Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload ).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023) In some cases, the system may not be able to boot again. Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)

31 recorded

Relationships

uses
from 2025 Poland Wiper Attacks
Campaign
uses
from AcidPour
Malware
uses
from AcidRain
Malware
uses
from Apostle
Malware
uses
from APT37
Group
uses
from APT38
Group
uses
from AvosLocker
Malware
uses
from BFG Agonizer
Malware
uses
from Black Basta
Malware
uses
from CanisterWorm
Malware
uses
from CHIMNEYSWEEP
Malware
uses
from DarkGate
Malware
uses
from DCSrv
Malware
uses
from DynoWiper
Malware
uses
from HermeticWiper
Malware
uses
from KillDisk
Malware
uses
from Latrodectus
Malware
uses
from Lazarus Group
Group
uses
from LockerGoga
Malware
uses
from LookBack
Malware
uses
from Maze
Malware
uses
from Medusa Group
Group
uses
from MultiLayer Wiper
Malware
uses
from NotPetya
Malware
uses
from Olympic Destroyer
Malware
uses
from Qilin
Malware
uses
from Remcos
Tool
uses
from Shamoon
Malware
uses
from ShrinkLocker
Malware
uses
from WhisperGate
Malware
uses
from XLoader
Malware
10 external

References

mitre-attack
T1529
open
Talos Nyetya June 2017
https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html
open
alert_TA18_106A
https://www.cisa.gov/uscert/ncas/alerts/TA18-106A
open
NotMe-BSOD
https://github.com/lzcapp/NotMe-BSOD
open
Talos Olympic Destroyer 2018
https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
open
Microsoft Shutdown Oct 2017
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
open
NtRaiseHardError
https://ntdoc.m417z.com/ntraiseharderror
open
Unit42 Agrius 2023
https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
open
SonicWall
https://www.sonicwall.com/blog/disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant
open
CrowdStrike Blog
https://www.crowdstrike.com/en-us/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance