cipher.exe

MITRE ATT&CK: S1205 View on attack.mitre.org

Aliases: cipher.exe

Operating systems
windows
Profile updated
2026-07-07 15:32:06

Context

cipher.exe is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).

Detection coverage

  • 1 Sigma rules

Malware & tools used

  • Disk Content Wipe (attack-pattern)

Used by threat actors

  • APT28 Nearest Neighbor Campaign (campaign)
  • APT28 (threat-actor)

Reports & references

  • MITRE ATT&CK — S1205 (report)
  • Microsoft — Cipher Exe Security Tool For The Encrypting File System 56C85Edd 85Cf Ac07 F2F7 Ca2D35Dab7E4 (report)

External references