Cipher.exe /w Used to Overwrite Free Disk Space (Anti-Forensics)
Detects the execution of the Windows cipher.exe utility with the /w flag, which is used to overwrite deleted data on a disk to prevent forensic recovery. This is a common technique used by adversaries to perform data destruction or cover their tracks.
SentinelOne
