Skip to main content

​
Overview

The LastShutdown command retrieves the timestamp of the last system shutdown from the registry. This information helps understand system uptime, reboot schedules, and can be useful for timeline analysis during investigations.

​
Syntax

Seatbelt.exe LastShutdown

​
Remote Execution

Seatbelt.exe LastShutdown -computername=TARGET.domain.com [-username=DOMAIN\user -password=pass]

​
Output

Returns:
  • Last shutdown date and time
  • Registry source of information

​
Use Cases

  • Red Team
  • Blue Team
  • Estimate system uptime
  • Plan persistence requiring reboots
  • Assess maintenance windows
  • Understand patch/reboot schedules

​
Example Output

====== LastShutdown ======

Last Shutdown : 10/15/2024 2:30:42 AM

​
Remote Execution

This command supports remote execution using the -computername parameter.

​
Detection Considerations

Minimal detection surface - reads single registry value.
  • OSInfo - Operating system information including boot time
  • PoweredOnEvents - Reboot and sleep schedule
  • Processes - Running processes with start times