Deleted Data Overwritten Via Cipher.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (ORIGINALFILENAME = "CIPHER.EXE" OR PROCESSNAME endswith "\cipher.exe") AND COMMANDLINE contains " /w:" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
