Windows Cipher.exe Overwrite Deleted Data Using /w

title: Windows Cipher.exe Overwrite Deleted Data Using /w
id: 24ca22c2-f355-4c8b-b3de-dd2cf69a7064
status: test
description: "This rule identifies execution of cipher.exe with the /w option, which overwrites deleted files on disk. Attackers can use this capability to hinder recovery and reduce evidence by destroying residual data on local drives. It relies on Windows process creation telemetry, specifically matching the process image name/path and the presence of the /w: command-line argument."
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml
author: frack113, Huntrule Team
date: 2021-12-26
modified: 2023-02-21
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: CIPHER.EXE
    - Image|endswith: \cipher.exe
  selection_cli:
    CommandLine|contains: " /w:"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml
simulation:
  - type: atomic-red-team
    name: Overwrite deleted data on C drive
    technique: T1485
    atomic_guid: 321fd25e-0007-417f-adec-33232252be19
license: DRL-1.1
related:
  - id: 4b046706-5789-4673-b111-66f25fe99534
    type: derived