MSR Kernel Module Loaded with Write Access Enabled

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the loading of the 'msr' kernel module with 'allow_writes=on', which grants userspace write access to CPU Model Specific Registers (MSRs). Attackers abuse this to disable hardware security mitigations, tamper with CPU microcode behavior, or as a primitive for Ring 0 exploitation. This behaviour is commonly observed in crypto-mining malware or advanced persistent threats (APTs).

2026-10-12 00:00:00

None

9a917937-2653-4422-ade3-201da3fbdb40

attack.defense-impairment attack.t1685 attack.persistence attack.privilege-escalation attack.t1547.006

Nextron Sigma feed only (private)