Possible Misuse of Linux Magic System Request Key (via auditd)

title: Possible Misuse of Linux Magic System Request Key (via auditd)
id: 7b5e102f-1556-5a6f-afc5-7f78cb792d40
status: stable
description: This rule detects the potential misuse of the Linux Magic SysRq (System Request) key by threat actors with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
references:
    - https://attack.mitre.org/techniques/T1499/
    - https://attack.mitre.org/techniques/T1489/
    - https://attack.mitre.org/techniques/T1529/
    - https://attack.mitre.org/techniques/T1059/004/
    - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel
    - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html
author: Huntrule Team
date: 2026-05-12
tags:
    - attack.execution
    - attack.t1059.004
    - attack.impact
    - attack.t1529
    - attack.t1489
    - attack.t1499
logsource:
    product: linux
    service: auditd
    definition: |
        Required auditd configuration:
        -w /proc/sysrq-trigger -p wa -k sysrq
        -w /proc/sys/kernel/sysrq -p wa -k sysrq
detection:
    selection:
        type: 'PATH'
        name|endswith:
            - '/sysrq'
            - '/sysctl.conf'
            - '/sysrq-trigger'
    condition: selection
falsepositives:
    - Unknown
level: medium