Linux dd File Overwrite/Deletion Attempt via of= and /dev/zero|/dev/null

Flags Linux dd executions that use of= with /dev/zero or /dev/null, consistent with file overwrite or deletion attempts.

FreeUnreviewedSigmalowv1

linux-dd-file-overwrite-deletion-attempt-via-of-and-dev-zero-dev-null-2953194b

title: Linux dd File Overwrite/Deletion Attempt via of= and /dev/zero|/dev/null
id: dfafd658-bd32-45ed-9a93-3c4199874a8c
status: test
description: This rule identifies Linux process executions of dd where the command line includes an output file argument (of=) and an input source of /dev/zero or /dev/null. This pattern can indicate attempts to overwrite or effectively delete file contents using dd, which is a common method for destructive impact. Detection relies on process creation telemetry capturing the dd image path and the full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-10-15
modified: 2022-07-07
tags:
  - attack.impact
  - attack.t1485
logsource:
  product: linux
  category: process_creation
detection:
  selection1:
    Image:
      - /bin/dd
      - /usr/bin/dd
  selection2:
    CommandLine|contains: of=
  selection3:
    CommandLine|contains:
      - if=/dev/zero
      - if=/dev/null
  condition: all of selection*
falsepositives:
  - Any user deleting files that way.
level: low
license: DRL-1.1
related:
  - id: 2953194b-e33c-4859-b9e8-05948c167447
    type: derived

What it detects

This rule identifies Linux process executions of dd where the command line includes an output file argument (of=) and an input source of /dev/zero or /dev/null. This pattern can indicate attempts to overwrite or effectively delete file contents using dd, which is a common method for destructive impact. Detection relies on process creation telemetry capturing the dd image path and the full command line.

Known false positives

Any user deleting files that way.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.