type:EXECVE a0:dd* (a1:if=\/dev\/null* OR a1:if=\/dev\/zero*)