attack.t1499

Potential Abuse of Linux Magic System Request Key

May 31, 2025 · attack.execution attack.t1059.004 attack.impact attack.t1529 attack.t1489 attack.t1499 ·

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

CVE-2024-49113 Exploitation Attempt - LDAP Nightmare

Jan 8, 2025 · attack.impact attack.t1499 cve.2024-49113 detection.emerging-threats ·

Share on:

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

Multiple Modsecurity Blocks

Apr 21, 2023 · attack.impact attack.t1499 ·

Share on:

Detects multiple blocks by the mod_security module (Web Application Firewall)