Title:
Overwriting the File with Dev Zero or Null
Status:
stable
Description:Detects overwriting (effectively wiping/deleting) of a file.
References:
-https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
Author: Jakob Weinzettl, oscd.community
Date: 2019-10-23
modified:None
Tags:
- -'attack.impact'
- -'attack.t1485'
Logsource:
- product: linux
- service: auditd
Detection:
selection:
type:
'EXECVE'
a0|contains:
'dd'
a1|contains:
-'if=/dev/null'
-'if=/dev/zero'
condition:
selection
Falsepositives:
-Appending null bytes to files.
-Legitimate overwrite of files.
Level:
low
