← Back to ATT&CK index
T1529
System Shutdown/Reboot
View on attack.mitre.org →4 syscalls implement this technique
- NtRaiseHardError
Raises a 'hard error' that the kernel routes to CSRSS for UI prompting — or, with SeShutdownPrivilege and FATAL severity, triggers an immediate bugcheck (BSOD).
- NtSetSystemPowerState
Transitions the system into the requested sleep, hibernate or working power state.
- NtInitiatePowerAction
Requests the power manager to perform a system-wide power action (sleep, hibernate, shutdown, reboot).
- NtShutdownSystem
Kernel-mode shutdown trigger — powers off, reboots or shuts down the system in one syscall.