Deletion of data on multiple drives using cipher exe

id: 65d15781-c7bf-447e-8c33-a2a94e727bf4
name: Deletion of data on multiple drives using cipher exe
description: |
  This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Ransomware
query: |
  // Look for cipher.exe deleting data from multiple drives
  DeviceProcessEvents
  | where Timestamp > ago(1d)
  | where FileName =~ "cipher.exe" 
  // cipher.exe /w flag used for deleting data 
  | where ProcessCommandLine has "/w" 
  | summarize CipherCount = dcount(ProcessCommandLine),
  CipherList = make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 1m) 
  // cipher.exe accessing multiple drives in a short timeframe 
  | where CipherCount > 1