Linux: Detect dd and truncate used to pad binaries and alter file contents
Flags Linux process executions of dd and truncate consistent with padding binaries to alter on-disk representation.
- Product
- linux
- Service
- auditd
- Author
- Igor Fits, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-13
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Linux process executions where an attacker may use dd to rewrite file content and optionally use truncate to pad with junk data, changing the on-disk representation. This can be used to evade detections that rely on file hashes or other static characteristics. It relies on auditd telemetry for EXECVE events and matches command-line keywords including dd with if=, truncate with -s, and file output arguments via of= handling.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: Detect dd and truncate used to pad binaries and alter file contents"
id: a1416c18-de71-4415-a0a5-1529d3c245be
status: test
description: This rule identifies Linux process executions where an attacker may use dd to rewrite file content and optionally use truncate to pad with junk data, changing the on-disk representation. This can be used to evade detections that rely on file hashes or other static characteristics. It relies on auditd telemetry for EXECVE events and matches command-line keywords including dd with if=, truncate with -s, and file output arguments via of= handling.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_binary_padding.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2023-05-03
tags:
- attack.stealth
- attack.t1027.001
logsource:
product: linux
service: auditd
detection:
selection_execve:
type: EXECVE
keywords_truncate:
"|all":
- truncate
- -s
keywords_dd:
"|all":
- dd
- if=
keywords_filter:
- of=
condition: selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter))
falsepositives:
- Unknown
level: high
simulation:
- type: atomic-red-team
name: Pad Binary to Change Hash - Linux/macOS dd
technique: T1027.001
atomic_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a
license: DRL-1.1
related:
- id: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba
type: derived