From cea80b95eeafe6eb9ad50837d18330e2236ab6db Mon Sep 17 00:00:00 2001
From: Alexander Sennhauser <63545149+conitrade-as@users.noreply.github.com>
Date: Mon, 16 Mar 2026 13:30:32 +0100
Subject: [PATCH] Adding cipher.exe entry (#274)

Co-authored-by: Wietze <wietze@users.noreply.github.com>
---
 CategoryList.md           |  2 ++
 yml/OSBinaries/Cipher.yml | 11 ++++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/CategoryList.md b/CategoryList.md
index 6bb3772..32bbdcc 100644
--- a/CategoryList.md
+++ b/CategoryList.md
@@ -3,6 +3,7 @@ CATEGORY LIST
 ADS   
 AWL bypass   
 Compile   
+Conceal   
 Copy   
 Credentials   
 Decode   
@@ -11,5 +12,6 @@ Dump
 Encode   
 Execute   
 Reconnaissance   
+Tamper   
 UAC bypass   
 Upload   
diff --git a/yml/OSBinaries/Cipher.yml b/yml/OSBinaries/Cipher.yml
index 2cdbe54..18d174e 100644
--- a/yml/OSBinaries/Cipher.yml
+++ b/yml/OSBinaries/Cipher.yml
@@ -6,11 +6,18 @@ Created: 2024-11-22
 Commands:
   - Command: cipher /w:{PATH_ABSOLUTE:folder}
     Description: Zero out a file
-    Usecase: Can be used to forensically erase a file
+    Usecase: Can be used to forensically erase a file.
     Category: Tamper
     Privileges: User
     MitreID: T1485
     OperatingSystem: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
+  - Command: cipher.exe /e {PATH_ABSOLUTE}
+    Description: Encrypt a file
+    Usecase: Can be used to impair defences by e.g. encrypting a critical EDR solution file.
+    Category: Tamper
+    Privileges: Admin
+    MitreID: T1562
+    OperatingSystem: Windows 10
 Full_Path:
   - Path: c:\windows\system32\cipher.exe
   - Path: c:\windows\syswow64\cipher.exe
@@ -22,3 +29,5 @@ Resources:
 Acknowledgement:
   - Person: Ade Ogunsowo
     Handle: "@i_am_tutu"
+  - Person: Alexander Sennhauser
+    Handle: '@conitrade'