MITRE ATT&CK / Software / S1205
cipher.exe ID S1205 Type Tool Platforms Windows Source attack.mitre.org MITRE last modified 11 Mar 2025 cipher.exe is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).[1]
Techniques used (1) Groups using it (1) References cipher.exe
Data: MITRE ATT&CK® Enterprise v20.0, from MITRE's official STIX bundle
(mitre-attack/attack-stix-data ),
fetched 15 Oct 2026 (Perth). Descriptions are MITRE's own text.
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
ATT&CK® is a registered trademark of The MITRE Corporation.
MITRE ATT&CK terms of use .
