Ransomware hits healthcare - Cipher.exe tool deleting data

id: afef7d05-0618-4bd7-9fbc-2e94ee764245
name: Ransomware hits healthcare - Cipher.exe tool deleting data
description: |
  // Look for cipher.exe deleting data from multiple drives.
  This is often performed as an anti-forensic measure prior to encryption.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)  
  | where FileName =~ "cipher.exe"  
  // Looking for /w flag for deleting  
  | where ProcessCommandLine has "/w"  
  | summarize CommandCount = dcount(ProcessCommandLine), 
  make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 1m)  
  // Looking for multiple drives in a short timeframe  
  | where CommandCount > 1