MBR Overwrite via Remote SSH for Disk Structure Wipe

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.