{"id":"4b046706-5789-4673-b111-66f25fe99534","title":"Deleted Data Overwritten Via Cipher.EXE","description":"Detects usage of the \"cipher\" built-in utility in order to overwrite deleted data from disk.\nAdversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.\nData destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives\n","author":"frack113","status":"test","level":"medium","date":"2021-12-26","modified":"2023-02-21","tags":["attack.impact","attack.t1485"],"technique_ids":["T1485"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive"],"source_path":"rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml","source_sha256":"4a0a817981ab4bd8108f71aae968132898d0a31ea5581352e30b49b15e94a9fb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Deleted Data Overwritten Via Cipher.EXE\nid: 4b046706-5789-4673-b111-66f25fe99534\nstatus: test\ndescription: |\n    Detects usage of the \"cipher\" built-in utility in order to overwrite deleted data from disk.\n    Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.\n    Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive\nauthor: frack113\ndate: 2021-12-26\nmodified: 2023-02-21\ntags:\n    - attack.impact\n    - attack.t1485\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - OriginalFileName: 'CIPHER.EXE'\n        - Image|endswith: '\\cipher.exe'\n    selection_cli:\n        CommandLine|contains: ' /w:'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Overwrite deleted data on C drive\n      technique: T1485\n      atomic_guid: 321fd25e-0007-417f-adec-33232252be19\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","page":"techniques/enterprise/T1485/"}],"data_path":"data/detection-rules/4b046706-5789-4673-b111-66f25fe99534.json","kind":"sigma"}