Name:Linux Magic SysRq Key Abuse id:22c03600-f84a-47fa-abaa-ffbe3e72c782 version:5 date:None author:Milad Cheraghi status:production type:TTP Description:Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system.
Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging.
Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
Correlate with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
Data_source:
-Linux Auditd Path
-Linux Auditd Cwd
search:`linux_auditd` (type=PATH OR type=CWD) | rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"
| stats values(type) as types values(name) as names values(nametype) as nametype values(cwd) as cwd_list values(_time) as event_times by audit_id, host
| stats count min(e_time) as firstTime max(e_time) as lastTime values(nametype) as nametype by current_working_directory reconstructed_path match_count dest audit_id
how_to_implement:To implement this detection, ensure auditd is configured to watch:
- /proc/sysrq-trigger
- /proc/sys/kernel/sysrq
- /etc/sysctl.conf
with write and attribute changes (`-p wa`) and key `sysrq`. Make sure the type=CWD record type is activate in your auditd configuration and
Use the Splunk Add-on for Unix and Linux for proper ingestion and CIM normalization.
This enables effective monitoring of Linux endpoints for SysRq abuse.
known_false_positives:Legitimate administrative activity modifying SysRq for debugging or recovery.
Please update the filter macros to remove false positives.
References: -https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt -https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel -https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest="$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Compromised Linux Host']
