Cipher.exe

File Encryption Utility

Paths

• c:\windows\system32\cipher.exe
• c:\windows\syswow64\cipher.exe

Commands

Tamper

Zero out a file

Use case: Can be used to forensically erase a file.

Privileges: User

cipher /w:{PATH_ABSOLUTE:folder}

Tamper

Encrypt a file

Use case: Can be used to impair defences by e.g. encrypting a critical EDR solution file.

Privileges: Admin

cipher.exe /e {PATH_ABSOLUTE}

Detection

• Sigma: https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml
• IOC: cipher.exe process with /w on the command line

Resources

• https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/