{"id":"2953194b-e33c-4859-b9e8-05948c167447","title":"DD File Overwrite","description":"Detects potential overwriting and deletion of a file using DD.","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"low","date":"2021-10-15","modified":"2022-07-07","tags":["attack.impact","attack.t1485"],"technique_ids":["T1485"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Any user deleting files that way."],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd"],"source_path":"rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml","source_sha256":"864cc354ce1607b884e7ab011be852890374b425e9695b2b2d579491feb22a11","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DD File Overwrite\nid: 2953194b-e33c-4859-b9e8-05948c167447\nstatus: test\ndescription: Detects potential overwriting and deletion of a file using DD.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-07-07\ntags:\n    - attack.impact\n    - attack.t1485\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection1:\n        Image:\n            - '/bin/dd'\n            - '/usr/bin/dd'\n    selection2:\n        CommandLine|contains: 'of='\n    selection3:\n        CommandLine|contains:\n            - 'if=/dev/zero'\n            - 'if=/dev/null'\n    condition: all of selection*\nfalsepositives:\n    - Any user deleting files that way.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","page":"techniques/enterprise/T1485/"}],"data_path":"data/detection-rules/2953194b-e33c-4859-b9e8-05948c167447.json","kind":"sigma"}