Detection rules › By eventMicrosoft-Windows-Eventlog event 11001 detection rule reference this event. View event page.Splunk (1)Windows Event Logging Service Has Shutdown T1070.001