Binary Padding via dd or truncate on Linux

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•39

This rule detects the use of 'dd' and 'truncate' commands to add junk data to a file, a technique adversaries may employ for binary padding to evade detection. Specifically, it looks for 'truncate' with the '-s' (size) option or 'dd' with 'if=' (input file) but without 'of=' (output file), indicating potential in-place modification or padding.