File Encryption Utility Located at: c:\windows\system32\cipher.exe; c:\windows\syswow64\cipher.exe.
ciphercipherSandbox: execFile · Timeout: 30s
security.defense-evasion.tamper Outputs
process.output Command execution output
filesystem_write Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Zero out a file (Can be used to forensically erase a file.)
cipher /w:{PATH_ABSOLUTE:folder}Encrypt a file (Can be used to impair defences by e.g. encrypting a critical EDR solution file.)
cipher.exe /e {PATH_ABSOLUTE}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml |
| ioc | cipher.exe process with /w on the command line |
cipher is a Windows LOLBin. File Encryption Utility Located at: c:\windows\system32\cipher.exe; c:\windows\syswow64\cipher.exe.