Sigma rule: Potential Abuse of Linux Magic System Request Key

Rule

Title

Potential Abuse of Linux Magic System Request Key

Status

experimental

Level

medium

Author

Milad Cheraghi

Date

2025-05-23

File

rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

Log source

product

linux

service

auditd

definition

Required auditd configuration: -w /proc/sysrq-trigger -p wa -k sysrq -w /proc/sys/kernel/sysrq -p wa -k sysrq

Detection

selection:
    type: 'PATH'
    name|endswith:
        # Enable
        - '/sysrq'
        - '/sysctl.conf'
        # Execute
        - '/sysrq-trigger'
condition: selection

False positives (as the rule lists them)

• Legitimate administrative activity

Tags

• attack.execution
• attack.t1059.004
• attack.impact
• attack.t1529
• attack.t1489
• attack.t1499

MITRE ATT&CK ids this rule names

• T1059.004
• T1489
• T1499
• T1529

References

• https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel
• https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml