path | Detection.FYI

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

System and Hardware Information Discovery

Dec 8, 2025 · attack.discovery attack.t1082 ·

Share on:

Detects system information discovery commands

Systemd Service Creation

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.t1543.002 ·

Share on:

Detects a creation of systemd services which could be used by adversaries to execute malicious code.

Unix Shell Configuration Modification

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.t1546.004 ·

Share on:

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

Use Of Hidden Paths Or Files

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·

Share on:

Detects calls to hidden files or files located in hidden directories in NIX systems.