Suspicious PUA - NirCmd Execution (via process_creation)

title: Suspicious PUA - NirCmd Execution (via process_creation)
id: 733b8e75-03c3-5864-9316-90d0144b7f4c
status: stable
description: This rule detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative behavior
references:
    - https://attack.mitre.org/techniques/T1569/002/
    - https://www.nirsoft.net/utils/nircmd.html
    - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
    - https://www.nirsoft.net/utils/nircmd2.html#using
author: Huntrule Team
date: 2026-04-19
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    category: process_creation
    product: windows
detection:
    selection_org:
        - Image|endswith: '\NirCmd.exe'
        - OriginalFileName: 'NirCmd.exe'
    selection_cmd:
        CommandLine|contains:
            - ' execmd '
            - '.exe script '
            - '.exe shexec '
            - ' runinteractive '
    combo_exec:
        CommandLine|contains:
            - ' exec '
            - ' exec2 '
    combo_exec_params:
        CommandLine|contains:
            - ' show '
            - ' hide '
    condition: 1 of selection_* or all of combo_*
falsepositives:
    - Unknown
level: medium