Disk Content Wiped via Remote SSH dd Command

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•8

This rule detects the execution of the 'dd if=/dev/zero' command over an SSH connection. This command is commonly used to wipe disk content by overwriting it with zeros, which can be an indicator of malicious activity aimed at destroying data or hindering forensic analysis. The rule specifically looks for this string within TCP traffic directed to port 22 (SSH).