Tamper Defense Evasion Windows Zero out a file Use Can be used to forensically erase a file. cipher /w:{PATH_ABSOLUTE:folder} copy Contextuser NativeTamper MITRET1485 DetectionSigma: github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.ymlIOC: cipher.exe process with /w on the command line Refswww.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/lolbas-project.github.io/lolbas/Binaries/Cipher/
Tamper Defense Evasion Windows Encrypt a file Use Can be used to impair defences by e.g. encrypting a critical EDR solution file. cipher.exe /e {PATH_ABSOLUTE} copy Contextadmin NativeTamper MITRET1562 DetectionSigma: github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.ymlIOC: cipher.exe process with /w on the command line Refswww.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/lolbas-project.github.io/lolbas/Binaries/Cipher/