Clear Unallocated Sector Using Cipher App

The analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. This activity is a technique used by ransomware to prevent forensic recovery of deleted files, hindering incident response efforts by making it impossible to recover critical data.