DD File Overwrite

Title: DD File Overwrite
Status: test
Description:Detects potential overwriting and deletion of a file using DD.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-10-15
modified:2022-07-07
Tags:

• -'attack.impact'
• -'attack.t1485'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection1:
    Image:
      -'/bin/dd'
      -'/usr/bin/dd'

  selection2:
    CommandLine|contains: 'of='
  selection3:
    CommandLine|contains:
      -'if=/dev/zero'
      -'if=/dev/null'

  condition:all of selection*
Falsepositives:
  -Any user deleting files that way.
Level: low