Detection rules › Sigma

Deleted Data Overwritten Via Cipher.EXE

Severity
medium
Author
frack113
Source
upstream

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

MITRE ATT&CK coverage

TacticTechniques
ImpactT1485 Data Destruction

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\cipher.exe'
OriginalFileName: CIPHER.EXE

Stage 2: all of selection_cli

CommandLine|contains: ' /w:'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /w:
Imageends_with
  • \cipher.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • CIPHER.EXE