Ransomware hits healthcare - Cipher.exe tool deleting data
// Look for cipher.exe deleting data from multiple drives. This is often performed as an anti-forensic measure prior to encryption.
Microsoft Sentinel (KQL)

// Look for cipher.exe deleting data from multiple drives. This is often performed as an anti-forensic measure prior to encryption.

Already have an account?