(Image:\/truncate CommandLine:\-s\ \+*) OR (Image:\/dd (CommandLine:if=\/dev\/zero* OR CommandLine:if=\/dev\/random* OR CommandLine:if=\/dev\/urandom*))