Suspicious Execution of Shutdown to Log Out — Detection Rule

Detects the rare use of the command line tool shutdown to logoff a user

Read the full analysis on IntelFusions