Potential Abuse of Linux Magic System Request Key

Milad Cheraghi

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

2025-05-23 00:00:00

None

ea61bb82-a5e0-42e6-8537-91d29500f1b9

attack.execution attack.t1059.004 attack.impact attack.t1529 attack.t1489 attack.t1499

Community Rule

Milad Cheraghi

Merge PR #5432 from @CheraghiMilad - Potential Abuse of Linux Magic System Request Key

2025-05-31