attack.t1489 | Detection.FYI

Potential Abuse of Linux Magic System Request Key

Dec 8, 2025 · attack.execution attack.t1059.004 attack.impact attack.t1529 attack.t1489 attack.t1499 ·
Share on:

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

Read More
Stop Windows Service Via Sc.EXE

Nov 26, 2025 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the "sc.exe" utility

Read More
Suspicious Windows Service Tampering

Sep 22, 2025 · attack.defense-evasion attack.impact attack.t1489 attack.t1562.001 ·
Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Read More
Azure Container Registry Created or Deleted

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects when a Container Registry is created or deleted.

Read More
Azure Kubernetes Cluster Created or Deleted

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects when a Azure Kubernetes Cluster is created or deleted.

Read More
Azure Kubernetes Network Policy Change

Jun 4, 2025 · attack.impact attack.credential-access attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a Azure Kubernetes network policy is modified or deleted.

Read More
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted

Jun 4, 2025 · attack.impact attack.credential-access attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Read More
Azure Kubernetes Secret or Config Object Access

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Read More
Azure Kubernetes Sensitive Role Access

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when ClusterRoles/Roles are being modified or deleted.

Read More
Azure Kubernetes Service Account Modified or Deleted

Jun 4, 2025 · attack.impact attack.t1531 attack.t1485 attack.t1496 attack.t1489 ·
Share on:

Identifies when a service account is modified or deleted.

Read More
Disable Important Scheduled Task

Aug 26, 2024 · attack.impact attack.t1489 ·
Share on:

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Read More
Application Uninstalled

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

An application has been removed. Check if it is critical.

Read More
Azure Application Deleted

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1489 ·
Share on:

Identifies when a application is deleted in Azure.

Read More
Delete All Scheduled Tasks

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Read More
Delete Important Scheduled Task

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Read More
Important Scheduled Task Deleted

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Read More
Stop Windows Service Via Net.EXE

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the "net" utility.

Read More
Stop Windows Service Via PowerShell Stop-Service

Aug 12, 2024 · attack.impact attack.t1489 ·
Share on:

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"

Read More