System Event ID 6008 — The previous system shutdown was unexpected

The system was shut down unexpectedly (no prior clean shutdown event). Indicates crash, power failure, or forced power off.

Why event 6008 matters

Unexpected shutdowns can indicate: hardware failure, BSOD caused by rootkit/malicious driver, physical access/hard power off, or hypervisor-level attack. Correlate with crash dumps if available.

How to detect it

Alert: unexpected shutdown on servers or critical systems. Correlate with BSOD (BugcheckCode in WER) and crash dumps. Multiple unexpected shutdowns = instability or active attack.

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Event
| where EventLog == "System" and EventID == 6008   // The previous system shutdown was unexpected
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:System" EventCode=6008
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The previous system shutdown was unexpected — add EventData fields: param1, param2, Computer`

Related Event Log Service events