cipher.exe is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).
| Technique | Procedure example |
|---|---|
| T1561.001 Disk Content Wipe |
cipher.exe can be used to overwrite deleted data in specified folders. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
