Deleted Data Overwritten Via Cipher.EXE
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- OriginalFileName: 'CIPHER.EXE'
- Image|endswith: '\cipher.exe'
selection_cli:
CommandLine|contains: ' /w:'
condition: all of selection_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Simulations
Overwrite deleted data on C drive
GUID: 321fd25e-0007-417f-adec-33232252be19
Tactics
Techniques