Linux auditd: dd overwrites a file using if=/dev/null or if=/dev/zero

Flags dd command lines that overwrite files by sourcing data from /dev/null or /dev/zero.

FreeUnreviewedSigmalowv1

linux-auditd-dd-overwrites-a-file-using-if-dev-null-or-if-dev-zero-37222991

title: "Linux auditd: dd overwrites a file using if=/dev/null or if=/dev/zero"
id: 04e79a91-d4b1-4d6f-b493-66cef4b8372f
status: stable
description: This rule identifies dd executions where the command line includes input from either /dev/null or /dev/zero, which effectively overwrites file contents with null/zero bytes. Attackers may use this behavior to wipe or destroy data on disk. It relies on Linux auditd EXECVE telemetry and matches dd arguments containing the specified if=/dev/null or if=/dev/zero patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_dd_delete_file.yml
author: Jakob Weinzettl, oscd.community, Huntrule Team
date: 2019-10-23
tags:
  - attack.impact
  - attack.t1485
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0|contains: dd
    a1|contains:
      - if=/dev/null
      - if=/dev/zero
  condition: selection
falsepositives:
  - Appending null bytes to files.
  - Legitimate overwrite of files.
level: low
license: DRL-1.1
related:
  - id: 37222991-11e9-4b6d-8bdf-60fbe48f753e
    type: derived

What it detects

This rule identifies dd executions where the command line includes input from either /dev/null or /dev/zero, which effectively overwrites file contents with null/zero bytes. Attackers may use this behavior to wipe or destroy data on disk. It relies on Linux auditd EXECVE telemetry and matches dd arguments containing the specified if=/dev/null or if=/dev/zero patterns.

Known false positives

Appending null bytes to files.
Legitimate overwrite of files.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.