Linux: Suspicious SysRq Trigger or Configuration Path Access

title: "Linux: Suspicious SysRq Trigger or Configuration Path Access"
id: 54bb2e70-4fef-4d75-a442-4fd7ee88a112
status: experimental
description: This rule flags process activity in auditd where the event type is PATH and the path name ends with /sysrq, /sysctl.conf, or /sysrq-trigger. Writing to /proc/sysrq-trigger or enabling SysRq via /proc/sys/kernel/sysrq can let an attacker manipulate or destabilize the host, potentially impacting availability and incident response. It relies on auditd PATH telemetry for file paths related to SysRq configuration and triggering.
references:
  - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
  - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel
  - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-23
tags:
  - attack.execution
  - attack.t1059.004
  - attack.impact
  - attack.t1529
  - attack.t1489
  - attack.t1499
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -w /proc/sysrq-trigger -p wa -k sysrq
    -w /proc/sys/kernel/sysrq -p wa -k sysrq
detection:
  selection:
    type: PATH
    name|endswith:
      - /sysrq
      - /sysctl.conf
      - /sysrq-trigger
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: medium
license: DRL-1.1
related:
  - id: ea61bb82-a5e0-42e6-8537-91d29500f1b9
    type: derived