Linux: Detect dd and truncate used to pad binaries and alter file contents

title: "Linux: Detect dd and truncate used to pad binaries and alter file contents"
id: a1416c18-de71-4415-a0a5-1529d3c245be
status: test
description: This rule identifies Linux process executions where an attacker may use dd to rewrite file content and optionally use truncate to pad with junk data, changing the on-disk representation. This can be used to evade detections that rely on file hashes or other static characteristics. It relies on auditd telemetry for EXECVE events and matches command-line keywords including dd with if=, truncate with -s, and file output arguments via of= handling.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_binary_padding.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2023-05-03
tags:
  - attack.stealth
  - attack.t1027.001
logsource:
  product: linux
  service: auditd
detection:
  selection_execve:
    type: EXECVE
  keywords_truncate:
    "|all":
      - truncate
      - -s
  keywords_dd:
    "|all":
      - dd
      - if=
  keywords_filter:
    - of=
  condition: selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter))
falsepositives:
  - Unknown
level: high
simulation:
  - type: atomic-red-team
    name: Pad Binary to Change Hash - Linux/macOS dd
    technique: T1027.001
    atomic_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a
license: DRL-1.1
related:
  - id: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba
    type: derived