huntrule

Linux dd Command Overwrite or Deletion via of= and input redirection

Flags Linux dd executions that use of= with /dev/zero or /dev/null, consistent with file overwrite or deletion attempts.

FreeReviewedSigma · Low · v3
Product
linux
Category
process_creation
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
Published
2021-10-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process creations where dd is invoked with output redirection (of=) and an input source that can indicate wiping or nulling (/dev/zero or /dev/null). Attackers may use dd to overwrite or delete data by writing raw bytes directly to files or devices. The detection relies on process creation telemetry including the executed image path and the command-line arguments used by dd.

Reporting behind it

Related detections9 linkedT1485 — drag to rearrange
Malicious JADEPUFFER Ransom Database Table Manipulation
Suspicious Self-Deleting Batch Script Execution Consistent with Agonizing Serpens Wiper Cleanup
Malicious Mass Device Wipe via Intune Remote Actions (via m365)
Malicious S3 Bucket Deletion During Bling Libra Extortion
Malicious DYNOWIPER PowerShell Loader Execution (via ps_script)
Suspicious S3 Lifecycle Policy Set for Rapid Object Deletion
Malicious PathWiper Loader Script Execution from Windows Temp via WScript
Suspicious Free Space Wipe via cipher.exe
Suspicious sha256sum.exe Execution from Windows Temp Directory
Linux dd Command Overwrite or Deletion via of= and input redirection
Pivot detection · T1485 · 9 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.