{"id":"T1489","name":"Service Stop","url":"https://attack.mitre.org/techniques/T1489","tactics":["impact"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0021","stix_id":"x-mitre-detection-strategy--ae37afa8-87d5-4091-ac33-010e78eefe97","name":"Behavioral Detection for Service Stop across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0021","analytics":[{"id":"AN0061","stix_id":"x-mitre-analytic--00449d4c-48c7-4977-bf38-86fbc4e79285","name":"Analytic 0061","description":"Adversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486). Behavioral chain: Elevated execution context + stop-service or sc.exe or ChangeServiceConfigW + terminated or disabled service + possible follow-up file manipulation.","url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0061","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4672","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:System","channel":"EventCode=7036","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Sysmon","channel":"EventCode=4","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Time span between elevated privilege use and critical service stop"},{"field":"ServiceName","description":"Service names of interest (e.g., MSExchangeIS, SQLSERVERAGENT)"},{"field":"ParentProcess","description":"Upstream process lineage leading to service stop"}],"live":true,"detection_strategies":["DET0021"],"techniques":["T1489"]},{"id":"AN0062","stix_id":"x-mitre-analytic--ea793457-89e6-47d2-8ae1-7fd2bd814f82","name":"Analytic 0062","description":"Adversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.","url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0062","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve of systemctl or service stop","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"unlink/unlinkat on service binaries or data targets","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"service stopped messages","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"TimeWindow","description":"Window between service stop and suspicious file deletion"},{"field":"ExecUser","description":"Username or UID executing service stop command"}],"live":true,"detection_strategies":["DET0021"],"techniques":["T1489"]},{"id":"AN0063","stix_id":"x-mitre-analytic--86ea7b9c-c017-463d-b5d5-377f6dbfae1e","name":"Analytic 0063","description":"Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.","url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0063","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"launchctl disable or bootout calls","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"macos-unifiedlog"},{"name":"auditd:SYSCALL","channel":"execve of launchctl or pkill","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ServiceLabel","description":"Launch daemon label or name targeted by command"},{"field":"LaunchType","description":"Whether the command disables or boots out the service"}],"live":true,"detection_strategies":["DET0021"],"techniques":["T1489"]},{"id":"AN0064","stix_id":"x-mitre-analytic--9e12e1f0-1547-4008-8755-2b3bc1c00279","name":"Analytic 0064","description":"Attacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.","url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0064","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"Stop VM or disable service events via vim-cmd","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"esxi-hostd"},{"name":"esxi:hostd","channel":"Log entries indicating VM powered off or forcibly terminated","data_component":"DC0033","data_component_name":"Process Termination","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"VMName","description":"Targeted virtual machine name"},{"field":"InitiatorUser","description":"User who issued stop or disable command"}],"live":true,"detection_strategies":["DET0021"],"techniques":["T1489"]}],"live":true,"version":"1.0","techniques":["T1489"]}],"sigma_rules":[{"id":"08d6ac24-c927-4469-b3b7-2e422d6e3c43","title":"Azure Kubernetes Network Policy Change","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a Azure Kubernetes network policy is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"12d027c3-b48c-4d9d-8bb6-a732200034b2","title":"Azure Kubernetes Service Account Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a service account is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1531","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml","techniques":["T1531","T1485","T1496","T1489"],"cves":[]},{"id":"220457c1-1c9f-4c2e-afe6-9598926222c1","title":"Delete All Scheduled Tasks","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-09","modified":null,"description":"Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1489"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_delete_all.yml","techniques":["T1489"],"cves":[]},{"id":"25cb259b-bbdc-4b87-98b7-90d7c72f8743","title":"Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"410d2a41-1e6d-452f-85e5-abdd8257a823","title":"Azure Application Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-09-03","modified":"2026-04-30","description":"Identifies when a application is deleted in Azure.","references":["https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy","https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory","https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.impact","attack.t1489"],"path":"rules/cloud/azure/audit_logs/azure_application_deleted.yml","techniques":["T1489"],"cves":[]},{"id":"570ae5ec-33dc-427c-b815-db86228ad43e","title":"Application Uninstalled","author":"frack113","status":"test","level":"low","date":"2022-01-28","modified":"2022-09-17","description":"An application has been removed. Check if it is critical.","references":["https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml","https://learn.microsoft.com/en-us/windows/win32/msi/event-logging"],"logsource":{"product":"windows","service":"application"},"tags":["attack.impact","attack.t1489"],"path":"rules/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml","techniques":["T1489"],"cves":[]},{"id":"7ee0b4aa-d8d4-4088-b661-20efdf41a04c","title":"Azure Kubernetes Secret or Config Object Access","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"818fee0c-e0ec-4e45-824e-83e4817b0887","title":"Azure Kubernetes Sensitive Role Access","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when ClusterRoles/Roles are being modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"81bcb81b-5b1f-474b-b373-52c871aaa7b1","title":"Stop Windows Service Via Sc.EXE","author":"Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-03-05","modified":"2024-01-18","description":"Detects the stopping of a Windows service via the \"sc.exe\" utility","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11)"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1489"],"path":"rules/windows/process_creation/proc_creation_win_sc_stop_service.yml","techniques":["T1489"],"cves":[]},{"id":"86085955-ea48-42a2-9dd3-85d4c36b167d","title":"Process Terminated Via Taskkill","author":"frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali","status":"test","level":"low","date":"2021-12-26","modified":"2024-10-06","description":"Detects execution of \"taskkill.exe\" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity.\nAttackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1489/T1489.md#atomic-test-3---windows---stop-service-by-killing-process","https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1489","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_taskkill_execution.yml","techniques":["T1489"],"cves":[]},{"id":"88872991-7445-4a22-90b2-a3adadb0e827","title":"Stop Windows Service Via Net.EXE","author":"Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-03-05","modified":null,"description":"Detects the stopping of a Windows service via the \"net\" utility.","references":["https://ss64.com/nt/net-service.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1489"],"path":"rules/windows/process_creation/proc_creation_win_net_stop_service.yml","techniques":["T1489"],"cves":[]},{"id":"93e0ef48-37c8-49ed-a02c-038aab23628e","title":"Azure Container Registry Created or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-08-07","modified":"2022-08-23","description":"Detects when a Container Registry is created or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"9541f321-7cba-4b43-80fc-fbd1fb922808","title":"Azure Kubernetes Cluster Created or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-08-07","modified":"2022-08-23","description":"Detects when a Azure Kubernetes Cluster is created or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"9ac94dc8-9042-493c-ba45-3b5e7c86b980","title":"Disable Important Scheduled Task","author":"frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior","status":"test","level":"high","date":"2021-12-26","modified":"2026-03-11","description":"Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task","https://twitter.com/MichalKoczwara/status/1553634816016498688","https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1489"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_disable.yml","techniques":["T1489"],"cves":[]},{"id":"9e3cb244-bdb8-4632-8c90-6079c8f4f16d","title":"Important Scheduled Task Deleted or Disabled","author":"frack113","status":"test","level":"high","date":"2023-01-13","modified":"2026-03-11","description":"Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities\n","references":["https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/"],"logsource":{"product":"windows","service":"taskscheduler"},"tags":["attack.impact","attack.t1489"],"path":"rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable.yml","techniques":["T1489"],"cves":[]},{"id":"c49c5062-0966-4170-9efd-9968c913a6cf","title":"Stop Windows Service Via PowerShell Stop-Service","author":"Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-03-05","modified":null,"description":"Detects the stopping of a Windows service via the PowerShell Cmdlet \"Stop-Service\"","references":["https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service?view=powershell-7.4"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1489"],"path":"rules/windows/process_creation/proc_creation_win_powershell_stop_service.yml","techniques":["T1489"],"cves":[]},{"id":"ce72ef99-22f1-43d4-8695-419dcb5d9330","title":"Suspicious Windows Service Tampering","author":"Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)","status":"test","level":"high","date":"2022-09-01","modified":"2025-08-27","description":"Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts\n","references":["https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg","https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md","https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/","https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955","https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.defense-impairment","attack.t1489","attack.t1685"],"path":"rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml","techniques":["T1489","T1685"],"cves":[]},{"id":"dbc1f800-0fe0-4bc0-9c66-292c2abe3f78","title":"Delete Important Scheduled Task","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-09","modified":"2026-03-11","description":"Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1489"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_delete.yml","techniques":["T1489"],"cves":[]},{"id":"de25eeb8-3655-4643-ac3a-b662d3f26b6b","title":"Disable Or Stop Services","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-15","modified":"2025-03-18","description":"Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.\nAttackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.\n","references":["https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685","attack.impact","attack.t1489"],"path":"rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml","techniques":["T1685","T1489"],"cves":[]},{"id":"ea61bb82-a5e0-42e6-8537-91d29500f1b9","title":"Potential Abuse of Linux Magic System Request Key","author":"Milad Cheraghi","status":"experimental","level":"medium","date":"2025-05-23","modified":null,"description":"Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges\nto silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,\nor disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be\nmisused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.\n","references":["https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt","https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel","https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.execution","attack.t1059.004","attack.impact","attack.t1529","attack.t1489","attack.t1499"],"path":"rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml","techniques":["T1059.004","T1529","T1489","T1499"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-36884","state":"stale","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}