Identifier / Programs / Windows
cipher.exe
Displays or alters the encryption of directories and files on NTFS volumes. Windows commands reference
LOLBAS Tamper 2 Sigma rules name it 1 ATT&CK technique 2 documented commands 12 known copies with hashes
How cipher.exe is abused
Tamper T1485 Data Destruction
/wRemoves data from available unused disk space on the entire volume. Windows commands referenceTamper T1562
/eEncrypts the specified files or directories. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for cipher.exe.
2 documented commands
Tamper T1485 Data Destruction User privileges
Zero out a file
cipher /w:{PATH_ABSOLUTE:folder}Trips 1 Sigma rule: mediumDeleted Data Overwritten Via Cipher.EXE by frack113
Tamper T1562 Admin privileges
Encrypt a file
cipher.exe /e {PATH_ABSOLUTE}Trips no Sigma process-creation rule.
1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for cipher.exe, by Adetutu Ogunsowo, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for cipher.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real cipher.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cipher.exe · signed by Microsoft Windows
5a3a71038328b00063070800267b28668d80a682ec07ac678b650000523bec5710.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cipher.exe · signed by Microsoft Windows
fb41cfce1f66c01467443124e05340bf5f4b4023c092dc02ed3c56bfe03c872a10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cipher.exe · signed by Microsoft Windows
0b26b46319ce5332ac61dc2d4767368af0c5fd0475b0b82304ab3ab621952ece10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cipher.exe · signed by Microsoft Windows
a6b2cfde3e3de872d9edd6a16710ed6c8ee32a0dfcf57322b27b3da8d18ae71a10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cipher.exe · signed by Microsoft Windows
447e48ad8d608745d6265eb52e7a2b3f42a8edcd5b301ff91dbd5fd0a3f0427410.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cipher.exe · signed by Microsoft Windows
e7af4522af0551441f6108056640c474dc594adaa79f9b9e9ef98d195d81b2e210.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\cipher.exe · signed by Microsoft Windows
1c7bafe5742197741fc3724753c952c9af890f8a6b2c61561c33caaba8cf07cc10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cipher.exe · signed by Microsoft Windows
bffe1b9f0b4139c5fcbf318149e54b71dd53daecf34d8e1f281549a02de1f33210.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\cipher.exe · signed by Microsoft Windows
5bffc65b70c4d0b2df18eed665f1cd16a72b93204cbd0ac9ee90edcf7714d81f10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\cipher.exe · signed by Microsoft Windows
f2c1d0936204911ab67deec718f8136257ddae477bf56bdeed296d197e8d72156.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\cipher.exe · not signed
067d2c6ee12ff31c08bc5752d5603a803fc67d0f97da3ea702b330a69b7dd7e86.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\cipher.exe · not signed
97244ed78de0ee8d6fb00a67b8720c8de6fa304a3c4238874e146198202b83cdFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Display information about a specific encrypted file or directory
cipher /c:path\to\file_or_directoryIdentify/cDisplays information on the encrypted file. Windows commands referenceencrypt a file or directory (files added later to the directory are also encrypted as the directory is marked)
cipher /e:path\to\file_or_directoryIdentify/eEncrypts the specified files or directories. Windows commands referenceMatches LOLBAS abuse: Tamper (T1562)
decrypt a file or directory
cipher /d:path\to\file_or_directoryIdentify/dDecrypts the specified files or directories. Windows commands referenceOf the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of cipher.exe
/bAborts if an error is encountered./cDisplays information on the encrypted file./dDecrypts the specified files or directories./eEncrypts the specified files or directories./hDisplays files with hidden or system attributes./kCreates a new certificate and key for use with Encrypting File System (EFS) files./rGenerates an EFS recovery agent key and certificate, then writes them to a .pfx file (containing certificate and private key) and a .cer file (containing only the certificate)./sPerforms the specified operation on all subdirectories in the specified *directory*./uFinds all encrypted files on the local drive(s)./wRemoves data from available unused disk space on the entire volume./xBacks up the EFS certificate and keys to the specified file name./yDisplays your current EFS certificate thumbnail on the local computer./rekeyUpdates the specified encrypted file(s) to use the currently configured EFS key./removeuserRemoves a user from the specified file(s)./?Displays help at the command prompt.