System Event ID 1074 — The process has initiated the restart or shutdown of computer

A process initiated a system shutdown or restart. ProcessName, Reason, and Type are key. Type: 4=forced, 5=planned. Reason codes reveal whether planned or unexpected.

Why event 1074 matters

Forced reboots are used to complete ransomware deployment, apply malicious system changes, or clear in-memory forensic evidence. Reboots initiated by unexpected processes or at odd times warrant investigation.

How to detect it

Alert: shutdown/restart initiated by non-Windows Update, non-admin processes. Alert: restarts outside maintenance windows. Alert: Type=4 (forced, immediate) from unexpected processes. Correlate with 4688 to identify the initiating process.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Event
| where EventLog == "System" and EventID == 1074   // The process has initiated the restart or shutdown of computer
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:System" EventCode=1074
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The process has initiated the restart or shutdown of computer — add EventData fields: param1, param2, Computer`