---
{
  "title": "System Shutdown/Reboot",
  "summary": "Unauthorized shutdown or reboot interrupts service and can affect evidence availability.",
  "topic": "grc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    3
  ],
  "aliases": [
    "T1529"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1529: System Shutdown/Reboot",
      "url": "https://attack.mitre.org/techniques/T1529"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Unauthorized shutdown or reboot interrupts service and can affect evidence availability. Its role may be direct disruption or support for another operation.


## An investigation example

Several hosts reboot shortly after suspicious administrative actions and destructive activity.

## Evidence to examine

Review shutdown initiators, management records, operating-system events, uptime changes, and surrounding execution.

## A common analytical pitfall

Reboots also occur during approved maintenance and ordinary failures; corroborate the cause.

## Response considerations

Preserve available records and recover under a plan that accounts for the underlying compromise rather than treating rebooting as complete remediation.


## Availability and volatile evidence can both change

Shutdown and reboot are ordinary administrative actions, but unauthorized use can interrupt service and alter the evidence available to investigators. Memory state may disappear, processes restart, and logs may rotate or record a new startup sequence. The effect depends on the operating system, storage, application behavior, and logging arrangement.

Do not infer malicious intent from a reboot alone. Updates, hardware faults, power events, and approved maintenance are common explanations. Compare the initiating identity or process, management records, operating-system events, and timing. Centralized records can be especially valuable when the affected system is no longer available.

## A fictional interrupted assessment service

An academy's assessment server repeatedly restarts during an unusual administrative session. The response team checks whether a planned update explains the behavior and identifies the effect on active users. It preserves external monitoring and identity records while deciding whether volatile collection is feasible and appropriate.

The need to keep a service running can conflict with the need to preserve evidence. Make that tradeoff through the incident's authorized decision route rather than following a universal rule to always shut down or never shut down. Document the reason for the chosen action and the evidence that could not be retained.

## Rehearse the decision

For a fictional unstable server, list the business consequences of leaving it online, the risks of restarting it, and the evidence available from other sources. Identify who can authorize the decision. Then write a short record explaining the action and its limitations. The objective is defensible coordination, not memorizing one response for every possible system state.

Time interpretation needs care around startup. A system may correct its clock after contacting a time source, and monitoring may resume later than the actual boot. Compare clock context and independent observations before treating apparent event order as conclusive evidence of causation.

## Related concepts

- [[business-continuity]]
- [[disaster-recovery]]
- [[incident-response]]
- [[command-and-scripting-interpreter]]
- [[access-token-manipulation]]
- [[disk-wipe]]
- [[inhibit-system-recovery]]