Suspicious Execution of Shutdown to Log Out (ec290c06-9b6b-4338-8b6b-095c0f284f10)
Detects the rare use of the command line tool shutdown to logoff a user
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Suspicious Execution of Shutdown to Log Out (ec290c06-9b6b-4338-8b6b-095c0f284f10) | Sigma-Rules | System Shutdown/Reboot - T1529 (ff73aa03-0090-4464-83ac-f89e233c02bc) | Attack Pattern | 1 |