macOS: Detect dd and truncate usage for binary padding

Flags macOS dd plus truncate command lines consistent with adding junk data for binary padding.

FreeUnreviewedSigmahighv1

macos-detect-dd-and-truncate-usage-for-binary-padding-95361ce5

title: "macOS: Detect dd and truncate usage for binary padding"
id: d9fc054a-e418-40ef-ab7f-2b0797bb5be4
status: test
description: This rule identifies macOS process executions that use dd with /dev/zero, /dev/random, or /dev/urandom as input, and truncate with a size change argument ("-s +"), consistent with adding junk data to alter a file’s on-disk representation. Adding padding can help attackers evade detection or manipulate how malware is analyzed or stored. The detection relies on process creation telemetry capturing the executable path (dd/truncate) and relevant command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
  - https://linux.die.net/man/1/truncate
  - https://linux.die.net/man/1/dd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_binary_padding.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2023-02-17
tags:
  - attack.stealth
  - attack.t1027.001
logsource:
  product: macos
  category: process_creation
detection:
  selection_truncate:
    Image|endswith: /truncate
    CommandLine|contains: -s +
  selection_dd:
    Image|endswith: /dd
    CommandLine|contains:
      - if=/dev/zero
      - if=/dev/random
      - if=/dev/urandom
  condition: 1 of selection_*
falsepositives:
  - Legitimate script work
level: high
license: DRL-1.1
related:
  - id: 95361ce5-c891-4b0a-87ca-e24607884a96
    type: derived

What it detects

This rule identifies macOS process executions that use dd with /dev/zero, /dev/random, or /dev/urandom as input, and truncate with a size change argument ("-s +"), consistent with adding junk data to alter a file’s on-disk representation. Adding padding can help attackers evade detection or manipulate how malware is analyzed or stored. The detection relies on process creation telemetry capturing the executable path (dd/truncate) and relevant command-line arguments.

Known false positives

Legitimate script work

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.