truncate

Set length of file(s), extending sparsely if necessary. toybox

On Linux 2 Sigma rules name it

Linux

from the toybox, 0BSD

Set length of file(s), extending sparsely if necessary. SIZE prefix: + add, - subtract, < shrink to, > expand to, / multiple rounding down, % multiple rounding up SIZE suffix: k=1024, m=1024^2, g=1024^3, t=1024^4, p=1024^5, e=1024^6

truncate [-c] -s SIZE file...

-cDon't create file if it doesn't exist

-sNew size (with optional prefix and suffix)

Several platforms

from tldr-pages, CC BY 4.0

Shrink or extend the size of a file to the specified size.

Set a size of 10 GB to an existing file, or create a new file with the specified size

truncate --size 10G path/to/fileIdentify

Extend the file size by 50 MiB, fill with holes (which reads as zero bytes)

truncate --size +50M path/to/fileIdentify

Shrink the file by 2 GiB, by removing data from the end of file

truncate --size -2G path/to/fileIdentify

Empty the file's content

truncate --size 0 path/to/fileIdentify

Empty the file's content, but do not create the file if it does not exist

truncate --size 0 --no-create path/to/fileIdentify

What detects it

Sigma process creation rules that name truncate

highBinary Padding - MacOSIgor Fits, Mikhail Larin, oscd.community

highSyslog Clearing or Removal Via System UtilitiesMax Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC