Detectionmediumtest

Deleted Data Overwritten Via Cipher.EXE

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Sun Dec 26Updated Tue Feb 214b046706-5789-4673-b111-66f25fe99534windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - OriginalFileName: 'CIPHER.EXE'
        - Image|endswith: '\cipher.exe'
    selection_cli:
        CommandLine|contains: ' /w:'
    condition: all of selection_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

Testing & Validation

Simulations

atomic-red-teamT1485
View on ART

Overwrite deleted data on C drive

GUID: 321fd25e-0007-417f-adec-33232252be19

Regression Tests

by SigmaHQ Team
Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

MITRE ATT&CK
Rule Metadata
Rule ID
4b046706-5789-4673-b111-66f25fe99534
Status
test
Level
medium
Type
Detection
Created
Sun Dec 26
Modified
Tue Feb 21
Path
rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml
Raw Tags
attack.impactattack.t1485
View on GitHub