Cipher.exe

Commands

1. TamperUser T1485

   Can be used to forensically erase a file.

   cipher /w:{PATH_ABSOLUTE:folder}

   Zero out a file

   os: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

2. TamperAdmin T1562

   Can be used to impair defences by e.g. encrypting a critical EDR solution file.

   cipher.exe /e {PATH_ABSOLUTE}

   Encrypt a file

   os: Windows 10

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml
• IOCcipher.exe process with /w on the command line

Resources

• https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/