Linux: Detect dd/ truncate binary padding used to alter on-disk file contents

title: "Linux: Detect dd/ truncate binary padding used to alter on-disk file contents"
id: a1416c18-de71-4415-a0a5-1529d3c245be
status: test
description: This rule flags Linux auditd EXECVE events invoking dd and truncate with options consistent with adding junk data or padding to a file. Attackers may use this to change a malware’s on-disk representation (e.g., hash or layout) without changing its intended behavior, supporting stealth and evasion. It relies on process execution telemetry from auditd and matches command-line keywords for dd (with if=) and truncate (with -s), while excluding dd commands that include of=.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_binary_padding.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2023-05-03
tags:
  - attack.stealth
  - attack.t1027.001
logsource:
  product: linux
  service: auditd
detection:
  selection_execve:
    type: EXECVE
  keywords_truncate:
    "|all":
      - truncate
      - -s
  keywords_dd:
    "|all":
      - dd
      - if=
  keywords_filter:
    - of=
  condition: selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter))
falsepositives:
  - Unknown
level: high
simulation:
  - type: atomic-red-team
    name: Pad Binary to Change Hash - Linux/macOS dd
    technique: T1027.001
    atomic_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a
license: DRL-1.1
related:
  - id: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba
    type: derived