{"id":"ea61bb82-a5e0-42e6-8537-91d29500f1b9","title":"Potential Abuse of Linux Magic System Request Key","description":"Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges\nto silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,\nor disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be\nmisused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.\n","author":"Milad Cheraghi","status":"experimental","level":"medium","date":"2025-05-23","modified":"","tags":["attack.execution","attack.t1059.004","attack.impact","attack.t1529","attack.t1489","attack.t1499"],"technique_ids":["T1059.004","T1489","T1499","T1529"],"logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-w /proc/sysrq-trigger -p wa -k sysrq\n-w /proc/sys/kernel/sysrq -p wa -k sysrq\n"},"falsepositives":["Legitimate administrative activity"],"references":["https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt","https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel","https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html"],"source_path":"rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml","source_sha256":"5fc561970df6c8b48ccd7b679800dee736cc8c792e1d7839e03f1920e0b36a49","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Abuse of Linux Magic System Request Key\nid: ea61bb82-a5e0-42e6-8537-91d29500f1b9\nstatus: experimental\ndescription: |\n    Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges\n    to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,\n    or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be\n    misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.\nreferences:\n    - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt\n    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel\n    - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html\nauthor: Milad Cheraghi\ndate: 2025-05-23\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.impact\n    - attack.t1529\n    - attack.t1489\n    - attack.t1499\nlogsource:\n    product: linux\n    service: auditd\n    definition: |\n        Required auditd configuration:\n        -w /proc/sysrq-trigger -p wa -k sysrq\n        -w /proc/sys/kernel/sysrq -p wa -k sysrq\ndetection:\n    selection:\n        type: 'PATH'\n        name|endswith:\n            # Enable\n            - '/sysrq'\n            - '/sysctl.conf'\n            # Execute\n            - '/sysrq-trigger'\n    condition: selection\nfalsepositives:\n    - Legitimate administrative activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"},{"key":"enterprise/T1489","id":"T1489","name":"Service Stop","page":"techniques/enterprise/T1489/"},{"key":"enterprise/T1499","id":"T1499","name":"Endpoint Denial of Service","page":"techniques/enterprise/T1499/"},{"key":"enterprise/T1529","id":"T1529","name":"System Shutdown/Reboot","page":"techniques/enterprise/T1529/"}],"data_path":"data/detection-rules/ea61bb82-a5e0-42e6-8537-91d29500f1b9.json","kind":"sigma"}