shutdown.exe
Summary
Windows Shutdown utility. Shuts down, restarts, or logs off the local or a remote computer. Can be used destructively or as part of ransomware to force restart after encryption.
shutdown.exe is the 1385th most commonly executed Windows program in EchoTrail's dataset, observed 892 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cscript.exe.
Behavior
Top Paths
- C:\Windows\System3296.97%
- C:\Windows\SysWOW643.03%
Top Hashes (SHA256)
- d4e68cc9cb1965d70134c68bd1a090e0afae5b8b3d8018c6b6564852ae7bf39629.99%
- 191b43f2f69c998131409d533bdc306c287d1ef83ef0cd74616b65a498c2fecd22.37%
- f96073c3442ea0a99b4945394007602772db36732d1511dc2068519526678f8a9.31%
- 7c8e3dbc64bcb84d6b58dbb0a633b6b0f0bcf6746eacedd93abe2c9c41e803187.98%
- a9abe5b78deda854d09118996b748d6ad3b35da3238fba8660602361e7323eb57.74%
- 20efe7be0c121916e296b33af2f4d96185e22207741d54f81c538295d222442d5.8%
- 751c6469ba416f559d7e38754be7352542e7f1a9483cd4a3345b966046c564a35.56%
- 6d262b3cbedac276c3eb960df923167fe0449218721334dcc48a561e981b57904.23%
- 53f8257aac5c4fe933769da955ffc5e3d6222e09002c3aa8c7446621e001d8bd2.66%
- 9f77783789d1a999cfa8b9d2c270c60b8352ac49ad30df21b3ce45362bf8cfb91.93%
Process Ancestry
Top Grandparents
- cscript.exe30.27%
- svchost.exe21.08%
- explorer.exe13.51%
- userinit.exe7.03%
- services.exe2.16%
- cmd.exe1.62%
- chrome.exe0.54%
- LTSVC.exe0.54%
- WUDFHost.exe0.54%
Top Parents
- cscript.exe61.21%
- explorer.exe18.95%
- cmd.exe9.87%
- powershell.exe4.93%
- DellUpService.exe0.67%
- HPUpdate.exe0.11%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does shutdown.exe normally do?
Runs from C:\Windows\System32. Used for planned shutdowns, restarts after updates, and scheduled maintenance.
When is shutdown.exe suspicious?
Remote shutdown commands (/m \\computername). Forced shutdown (/f) with no timeout (/t 0). Shutdown executed from unusual parent processes. Shutdown immediately after encryption activity (ransomware pattern).
How do attackers abuse shutdown.exe?
SYSTEM SHUTDOWN/REBOOT: Ransomware operators use "shutdown /r /f /t 0" to force reboot after encryption, displaying ransom notes. Remote shutdown (/m flag) can target multiple systems. Also used to disrupt operations or force users to encounter modified login screens (accessibility backdoors).
Detection guidance
MEDIUM-CONFIDENCE: - shutdown.exe with /m flag (remote shutdown) targeting multiple machines - shutdown.exe immediately after suspicious file encryption activity - shutdown.exe /r /f /t 0 from non-admin context DATA SOURCES: Process creation with command line (Sysmon 1), Windows shutdown events (1074)
False positive notes
IT operations scheduling restarts for patching. SCCM and WSUS triggering post-update reboots. Users shutting down their own machines. Scheduled task for maintenance windows.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about shutdown.exe
Rocky answers questions about shutdown.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.