Suspicious Execution of Shutdown — Detection Rule

Use of the commandline to shutdown or reboot windows

Read the full analysis on IntelFusions