Deleted Data Overwritten Via Cipher.EXE
Detects the use of the built-in Windows utility 'cipher.exe' with the '/w:' argument to overwrite deleted data on disk. This technique is often used by adversaries to destroy data and files, making them irrecoverable by forensic methods, thereby impacting system availability.
Sigma
