Anti-forensic free space wipe via cipher.exe /w
Detects the execution of the Windows cipher.exe utility with the /w flag, which is used to overwrite free space on a volume to permanently delete data, a common technique for anti-forensics and data destruction.
Splunk (SPL)
