macOS Process Execution: dd and truncate used for binary padding
Flags macOS dd plus truncate command lines consistent with adding junk data for binary padding.
- Product
- macos
- Category
- process_creation
- Author
- Igor Fits, Mikhail Larin, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-19
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies macOS process executions where an attacker uses dd to append or generate junk data for binary padding (e.g., using /dev/zero, /dev/random, or /dev/urandom) and uses truncate with a size argument (via -s +). Altering the on-disk representation of malware via padding can help evade static detection and change file hashes without changing core functionality. It relies on process creation telemetry capturing the executable path and command-line arguments for dd and truncate.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
- linux.die.nethttps://linux.die.net/man/1/truncate
- linux.die.nethttps://linux.die.net/man/1/dd
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_binary_padding.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS Process Execution: dd and truncate used for binary padding"
id: d9fc054a-e418-40ef-ab7f-2b0797bb5be4
status: test
description: This rule identifies macOS process executions where an attacker uses dd to append or generate junk data for binary padding (e.g., using /dev/zero, /dev/random, or /dev/urandom) and uses truncate with a size argument (via -s +). Altering the on-disk representation of malware via padding can help evade static detection and change file hashes without changing core functionality. It relies on process creation telemetry capturing the executable path and command-line arguments for dd and truncate.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
- https://linux.die.net/man/1/truncate
- https://linux.die.net/man/1/dd
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_binary_padding.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2023-02-17
tags:
- attack.stealth
- attack.t1027.001
logsource:
product: macos
category: process_creation
detection:
selection_truncate:
Image|endswith: /truncate
CommandLine|contains: -s +
selection_dd:
Image|endswith: /dd
CommandLine|contains:
- if=/dev/zero
- if=/dev/random
- if=/dev/urandom
condition: 1 of selection_*
falsepositives:
- Legitimate script work
level: high
license: DRL-1.1
related:
- id: 95361ce5-c891-4b0a-87ca-e24607884a96
type: derived