deleting-data-w-cipher-tool

id: ccf00363-6636-4748-9df5-a22f6cb977bd
name: deleting-data-w-cipher-tool
description: |
  This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
  In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
  The following query detects the use of the tool cipher.exe to delete indicators of malicious activity right before encrypting a drive.
  The See also section below lists more queries related to techniques shared by these campaigns.
  Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Defense evasion
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)  
  | where FileName =~ "cipher.exe"  
  // Looking for /w flag for deleting  
  | where ProcessCommandLine has "/w"  
  | summarize CommandCount = dcount(ProcessCommandLine), 
  make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 1m)  
  // Looking for multiple drives in a short timeframe  
  | where CommandCount > 1