Detection of Malicious File Overwriting via Linux dd Command

This threat brief focuses on the malicious abuse of the standard Linux 'dd' utility to perform unauthorized file overwriting. Adversaries leverage this command to irreversibly destroy target files or entire partitions, significantly impacting system availability and recovery capabilities. This technique is often associated with data destruction campaigns, such as those observed in the Industroyer2 ecosystem. Defenders must monitor process execution logs for 'dd' commands containing output redirection flags ('of=') that target sensitive system files or data directories. This activity is a high-confidence indicator of destructive intent when observed outside of legitimate administrative maintenance windows.

Impact

The abuse of the 'dd' command for file destruction can render a Linux system inoperable, resulting in critical data loss and extended downtime. Successful execution of these commands effectively deletes or corrupts files, requiring complete system re-imaging or restoration from secure offline backups, which may not be readily available for all impacted sectors.

Recommendation

• Deploy the provided Sigma rule to detect process execution of 'dd' with output redirection flags.
• Enable Sysmon for Linux or equivalent EDR telemetry to capture full command-line arguments for all executed processes.
• Establish a baseline of authorized administrative tasks to identify and filter out legitimate usage of 'dd' by system operators.
• Monitor for suspicious process parent-child relationships where 'dd' is spawned by unexpected shell processes or web services.