Settra Ransomware: cipher.exe /w Used to Overwrite Deleted Data
Detects the execution of the Windows cipher.exe utility with the '/w' flag from the command prompt. The '/w' flag is used to overwrite free space on a disk, which is a technique often used by adversaries to perform data destruction or hinder forensic recovery of deleted files.
Cortex XDR
