cipher.exeTool
cipher.exe is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).From MITRE ATT&CK
Last reported 2 years ago, by Huntress1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1543.003Windows Service
“These were followed by a series of "net stop" commands to halt various Windows services, as well as commands intended to inhibit recovery by deleting Volume Shadow Copies and system backups.”
What the reports say
1 report, newest first · the exact sentence from each-
ReadText34 Ransomware Incident“The cipher.exe native Windows utility is a command line tool that administrators can use to manage encrypted data using the Encrypted File System.”
Indicators in its reports
named in the reports above- 94.198.50[.]195in 1 report
- securitymy[.]namein 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.