Cipher.exe

File Encryption Utility

Tamper

Can be used to forensically erase a file.

cipher /w:{PATH_ABSOLUTE:folder}

Zero out a file — MITRE: T1485 — Privileges: User

Can be used to impair defences by e.g. encrypting a critical EDR solution file.

cipher.exe /e {PATH_ABSOLUTE}

Encrypt a file — MITRE: T1562 — Privileges: Admin