detection.wiki

Detection rules › Sigma

Overwriting the File with Dev Zero or Null

Status
stable
Severity
low
Log source
product linux, service auditd
Author
Jakob Weinzettl, oscd.community
Source
github.com/SigmaHQ/sigma

Detects overwriting (effectively wiping/deleting) of a file.

MITRE ATT&CK coverage

TacticTechniques
ImpactT1485 Data Destruction

Event coverage

ProviderEvent
Linux-AuditdEvent ID 1309

Rule body yaml

title: Overwriting the File with Dev Zero or Null
id: 37222991-11e9-4b6d-8bdf-60fbe48f753e
status: stable
description: Detects overwriting (effectively wiping/deleting) of a file.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
author: Jakob Weinzettl, oscd.community
date: 2019-10-23
tags:
    - attack.impact
    - attack.t1485
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'EXECVE'
        a0|contains: 'dd'
        a1|contains:
            - 'if=/dev/null'
            - 'if=/dev/zero'
    condition: selection
falsepositives:
    - Appending null bytes to files.
    - Legitimate overwrite of files.
level: low

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    type: 'EXECVE'
    a0|contains: 'dd'
    a1|contains:
        - 'if=/dev/null'
        - 'if=/dev/zero'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
a0match
  • dd
a1match
  • if=/dev/null
  • if=/dev/zero
typeeq
  • EXECVE