Linux dd Command Overwrite or Deletion via of= and input redirection

Flags Linux dd executions that use of= with /dev/zero or /dev/null, consistent with file overwrite or deletion attempts.

FreeReviewedSigma · Low · v3

Product: linux
Category: process_creation
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
Published: 2021-10-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1485Data Destruction

What it detects

This rule flags Linux process creations where dd is invoked with output redirection (of=) and an input source that can indicate wiping or nulling (/dev/zero or /dev/null). Attackers may use dd to overwrite or delete data by writing raw bytes directly to files or devices. The detection relies on process creation telemetry including the executed image path and the command-line arguments used by dd.

Reporting behind it

Related detections9 linkedT1485 — drag to rearrange

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

Suspicious Free Space Wipe via cipher.exe

Suspicious sha256sum.exe Execution from Windows Temp Directory

Suspicious Secure Deletion of Free Space via Cipher (via process_creation)

HamsaUpdate Wiper Trigger via F5UPDATER ConfirmDeleteFiles Argument (via process_creation)

Malicious Scheduled Task Deploying DYNOWIPER Payload (via process_creation)

Malicious Mini Shai-Hulud TanStack Destructive rm Killswitch (via process_creation)

Malicious S3 Object Encryption with Customer Provided Key via CopyObject

Malicious Cloud Storage Destruction by Cloud Build Service Account

Linux dd Command Overwrite or Deletion via of= and input redirection

Pivot detection · T1485 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-dd-file-overwrite-deletion-attempt-via-of-and-dev-zero-dev-null-2953194b

title: Linux dd Command Overwrite or Deletion via of= and input redirection
id: dfafd658-bd32-45ed-9a93-3c4199874a8c
status: test
description: This rule flags Linux process creations where dd is invoked with output redirection (of=) and an input source that can indicate wiping or nulling (/dev/zero or /dev/null). Attackers may use dd to overwrite or delete data by writing raw bytes directly to files or devices. The detection relies on process creation telemetry including the executed image path and the command-line arguments used by dd.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-10-15
modified: 2022-07-07
tags:
  - attack.impact
  - attack.t1485
logsource:
  product: linux
  category: process_creation
detection:
  selection1:
    Image:
      - /bin/dd
      - /usr/bin/dd
  selection2:
    CommandLine|contains: of=
  selection3:
    CommandLine|contains:
      - if=/dev/zero
      - if=/dev/null
  condition: all of selection*
falsepositives:
  - Any user deleting files that way.
level: low
license: DRL-1.1
related:
  - id: 2953194b-e33c-4859-b9e8-05948c167447
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL