shutdown.exe
Sources: 300M+ executions observed in the wild.
Summary
Windows Shutdown utility. Shuts down, restarts, or logs off the local or a remote computer. Can be used destructively or as part of ransomware to force restart after encryption.
shutdown.exe is the 1385th most commonly executed Windows program in EchoTrail's dataset, observed 892 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cscript.exe.
Get this in your tools
The same record for shutdown.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/shutdown.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3296.97%
- C:\Windows\SysWOW643.03%
Top Hashes (SHA256)
- d4e68cc9cb1965d70134c68bd1a090e0afae5b8b3d8018c6b6564852ae7bf39629.99%
- 191b43f2f69c998131409d533bdc306c287d1ef83ef0cd74616b65a498c2fecd22.37%
- f96073c3442ea0a99b4945394007602772db36732d1511dc2068519526678f8a9.31%
- 7c8e3dbc64bcb84d6b58dbb0a633b6b0f0bcf6746eacedd93abe2c9c41e803187.98%
- a9abe5b78deda854d09118996b748d6ad3b35da3238fba8660602361e7323eb57.74%
- 20efe7be0c121916e296b33af2f4d96185e22207741d54f81c538295d222442d5.8%
- 751c6469ba416f559d7e38754be7352542e7f1a9483cd4a3345b966046c564a35.56%
- 6d262b3cbedac276c3eb960df923167fe0449218721334dcc48a561e981b57904.23%
- 53f8257aac5c4fe933769da955ffc5e3d6222e09002c3aa8c7446621e001d8bd2.66%
- 9f77783789d1a999cfa8b9d2c270c60b8352ac49ad30df21b3ce45362bf8cfb91.93%
Process Ancestry
Top Grandparents
- cscript.exe30.27%
- svchost.exe21.08%
- explorer.exe13.51%
- userinit.exe7.03%
- services.exe2.16%
- cmd.exe1.62%
- chrome.exe0.54%
- LTSVC.exe0.54%
- WUDFHost.exe0.54%
Top Parents
- cscript.exe61.21%
- explorer.exe18.95%
- cmd.exe9.87%
- powershell.exe4.93%
- DellUpService.exe0.67%
- HPUpdate.exe0.11%
Top Children
- conhost.exe100%
Security Analysis
What does shutdown.exe normally do?
Runs from C:\Windows\System32. Used for planned shutdowns, restarts after updates, and scheduled maintenance.
When is shutdown.exe suspicious?
Remote shutdown commands (/m \\computername). Forced shutdown (/f) with no timeout (/t 0). Shutdown executed from unusual parent processes. Shutdown immediately after encryption activity (ransomware pattern).
How do attackers abuse shutdown.exe?
SYSTEM SHUTDOWN/REBOOT: Ransomware operators use "shutdown /r /f /t 0" to force reboot after encryption, displaying ransom notes. Remote shutdown (/m flag) can target multiple systems. Also used to disrupt operations or force users to encounter modified login screens (accessibility backdoors).
Detection guidance
MEDIUM-CONFIDENCE: - shutdown.exe with /m flag (remote shutdown) targeting multiple machines - shutdown.exe immediately after suspicious file encryption activity - shutdown.exe /r /f /t 0 from non-admin context DATA SOURCES: Process creation with command line (Sysmon 1), Windows shutdown events (1074)
False positive notes
IT operations scheduling restarts for patching. SCCM and WSUS triggering post-update reboots. Users shutting down their own machines. Scheduled task for maintenance windows.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about shutdown.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for shutdown.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.