Cipher.exe

Zero out a file

Use Can be used to forensically erase a file.

cipher /w:{PATH_ABSOLUTE:folder}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Tamper

MITRE

T1485

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml

IOC: cipher.exe process with /w on the command line

Refs

www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/

lolbas-project.github.io/lolbas/Binaries/Cipher/

Encrypt a file

Use Can be used to impair defences by e.g. encrypting a critical EDR solution file.

cipher.exe /e {PATH_ABSOLUTE}

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Tamper

MITRE

T1562

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml

IOC: cipher.exe process with /w on the command line

Refs

www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/

lolbas-project.github.io/lolbas/Binaries/Cipher/