Overwriting File with /dev/zero or /dev/null

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects attempts to overwrite or wipe files using the 'dd' command with '/dev/null' or '/dev/zero' as input. This technique is commonly used for data destruction, making files irrecoverable.