Possible data destruction via dd

BIOC Informational

Possible data destruction via dd

Attackers may use dd to zero out or write random data to files.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Tampering
Status:: Enabled

ATT&CK tactics: Impact (TA0040)

ATT&CK techniques: Data Destruction (T1485)

Indicator:

Process action type = execution AND target process cmd = *if=/dev/zero*of=* , *of=*if=/dev/zero* , *if=/dev/*random*of=* , *of=*if=/dev/*random* AND target process cmd != *of=/var/tmp* AND *of=/dev/stdout* AND target process name = dd

Preventable: yes