Junk data generated with dd, truncate or fallocate

Siemphony@siemphonylowT1027.001unverified

The discriminator in every analytic under this strategy is MITRE's FileSizeThresholdMB knob, and no log source in this brief carries a file size: Sysmon EventID 11 emits `TargetFilename` and the writing process, Security 4663/4656/4670 emit the object name and the access mask, and process creation events carry none — Sigma has no numeric comparison in any case. So this rule takes the Linux execve leg of AN1529 and matches the padding *act* instead of the padded artefact: the three utilities that generate bulk junk, gated on the arguments that mean "produce or grow by a quantity" rather than any use of the tool. Two limits follow directly. Shell redirection is consumed by the shell, so `dd ... >> implant` never puts the append or the target in the execve argv — the junk source is visible, the file it landed in is not. And padding is usually done on the adversary's build host before delivery, or inside a compiled dropper, neither of which produces any event on the victim at all. Prerequisite: auditd ships no execve rule by default, so without an explicit -a always,exit -F arch=b64 -S execve there is no process_creation telemetry on the host at all and this rule returns zero rows regardless of what ran. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0553, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/dd" and (ProcessCommandLine contains "if=/dev/urandom" or ProcessCommandLine contains "if=/dev/zero" or ProcessCommandLine contains "if=/dev/random")) or (FolderPath endswith "/truncate" and (ProcessCommandLine contains "-s +" or ProcessCommandLine contains "--size=+")) or (FolderPath endswith "/fallocate" and ProcessCommandLine contains "-l"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/dd" AND (CommandLine="*if=/dev/urandom*" OR CommandLine="*if=/dev/zero*" OR CommandLine="*if=/dev/random*")) OR (Image="*/truncate" AND (CommandLine="*-s +*" OR CommandLine="*--size=+*")) OR (Image="*/fallocate" AND CommandLine="*-l*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/dd" AND (TO_LOWER(process.command_line) LIKE "*if=/dev/urandom*" OR TO_LOWER(process.command_line) LIKE "*if=/dev/zero*" OR TO_LOWER(process.command_line) LIKE "*if=/dev/random*")) OR (TO_LOWER(process.executable) LIKE "*/truncate" AND (TO_LOWER(process.command_line) LIKE "*-s +*" OR TO_LOWER(process.command_line) LIKE "*--size=+*")) OR (TO_LOWER(process.executable) LIKE "*/fallocate" AND TO_LOWER(process.command_line) LIKE "*-l*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/dd$</field>    <field name="CommandLine" type="pcre2">(?i)(if=/dev/urandom|if=/dev/zero|if=/dev/random)</field>    <description>Junk data generated with dd, truncate or fallocate (1/3)</description>    <mitre>      <id>T1027.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/truncate$</field>    <field name="CommandLine" type="pcre2">(?i)(-s \+|--size=\+)</field>    <description>Junk data generated with dd, truncate or fallocate (2/3)</description>    <mitre>      <id>T1027.001</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/fallocate$</field>    <field name="CommandLine" type="pcre2">(?i)-l</field>    <description>Junk data generated with dd, truncate or fallocate (3/3)</description>    <mitre>      <id>T1027.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 28d1851f-e1ec-4b2e-8a56-4ba9fa256516

ATT&CKT1027.001

T1027.001Binary Padding

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

Binary padding: junk bytes appended to a payload so it changes hash, defeats size-limited scanning, or slips past a sandbox. Every analytic under DET0553 hangs on MITRE's FileSizeThresholdMB knob, and no log source in the brief carries a file size — Sysmon EID 11 gives a filename and a writer, Security 4663/4670 give an object and an access mask, process creation gives neither, and Sigma has no numeric comparison anyway. So this rule matches the padding act rather than the padded artefact: one of three Linux utilities invoked with arguments that mean "produce or grow by a quantity".

02 · Telemetry you need

process_creation/linux — the auditd execve leg of AN1529. auditd ships no execve rule by default, so without an explicit -a always,exit -F arch=b64 -S execve there is no process creation telemetry on the host at all and this rule returns zero rows regardless of what ran. Zero rows then reads as "nothing was padded" when it means "nothing is being watched", which is the worst failure available here. On BusyBox userlands — Alpine and most minimal container images — dd, truncate and fallocate are applets, so execve records /bin/busybox and all three gates below are dead.

03 · How the logic works

Each arm pairs a binary with an argument that shows bulk data is being produced, and any one arm firing is enough. The junk-source list for dd and the argument forms are the pipeline's own choices; MITRE names only the size threshold and the correlation window. Two limits follow from the shape. Shell redirection is consumed by the shell, so dd if=/dev/zero >> implant never puts the target file in argv — the junk source is visible, the file it landed in is not. And padding is usually done on the adversary's build host before delivery, or inside a compiled dropper, neither of which produces any event on the victim.

04 · Common false positives

Swap file creation is the loudest match by a wide margin: every cloud and distribution guide starts with dd if=/dev/zero of=/swapfile, and configuration management repeats it on first boot of every host. Disk throughput benchmarking uses the same one-liner. fallocate -l preallocating a database file, a VM image or a thin-pool volume is what the tool exists for. Secure-erase and decommissioning scripts zero whole devices. The fallocate arm is the weakest: -l as a bare substring is satisfied by any invocation with a length, and by a path such as /var/tmp/db-l, so in practice that arm means "fallocate ran".

05 · Detection maturity

tier_1: , the lowest tier, and it remains there until it has been run against real data — it has never seen a log line. The low level is honest: the expected population of matches is swap creation and benchmarking, with the technique a small minority inside it. AN1528 (Windows) and AN1530 (macOS) are unbuilt.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Replace the -l and -s + substrings with a size regex such as -{1,2}s(ize=|\s+)\+?[0-9]+[kKmMgG] — this both tightens the arm and picks up truncate -s 100M implant, the absolute form most walkthroughs use, which the current +-only gate misses entirely. Filter provisioning and benchmarking identities. Treat a match as a lead, not evidence: it becomes T1027.001 only alongside a second observation — the grown file later executing, or a chmod +x on it. That join is MITRE's TimeWindow knob, and Sigma cannot express it.

Declared by the author

Swap file creation. Every cloud and distribution guide for adding swap starts with dd if=/dev/zero of=/swapfile, and provisioning and configuration-management runs repeat it on first boot of each host — this is the loudest match here by a wide margin and is the reason the level is low.
Disk throughput benchmarking and storage acceptance tests, where dd if=/dev/zero writing a large test file is the standard one-liner in ops runbooks and in monitoring or QA scripts.
Preallocation of database, VM and container disk images with fallocate -l, which is what the tool exists for and what qemu, LVM thin-pool and database initialisation scripts do routinely.
Zeroing or randomising a device before decommissioning, before shrinking a VM image or as part of a secure-erase script, using dd with /dev/zero or /dev/urandom against a whole disk or partition.
Test fixtures and quota testing that grow a sparse file in place with truncate -s +SIZE rather than writing real data.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/28d1851f-e1ec-4b2e-8a56-4ba9fa256516

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Junk data generated with dd, truncate or fallocate

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it