Cipher Disk Wipe via PowerShell or Cmd

Detects the usage of the Windows native Cipher tool within PowerShell or cmd.exe to wipe the contents of the C Drive. The rule specifically looks for the 'cipher /W:C' command, which is used to remove data from available unused disk space on the C: drive, making previously deleted data unrecoverable.