Windows Process Creation: NirCmd runasSystem CommandLine Usage

Alerts on NirCmd being used to run commands as LocalSystem based on the process command line.

FreeUnreviewedSigmahighv1

windows-process-creation-nircmd-runassystem-commandline-usage-d9047477

title: "Windows Process Creation: NirCmd runasSystem CommandLine Usage"
id: d1edd47b-1dc4-4022-adba-f3dd710a8221
status: test
description: This rule flags Windows process creation events where the command line contains the ' runassystem ' string, indicating use of NirCmd to execute commands in the LocalSystem context. Attackers can leverage this capability to elevate execution privileges and run actions with high authority. The detection relies on process creation telemetry and the recorded command line content.
references:
  - https://www.nirsoft.net/utils/nircmd.html
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
  - https://www.nirsoft.net/utils/nircmd2.html#using
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_nircmd_as_system.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-24
modified: 2023-02-13
tags:
  - attack.execution
  - attack.t1569.002
  - attack.s0029
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: " runassystem "
  condition: selection
falsepositives:
  - Legitimate use by administrators
level: high
license: DRL-1.1
related:
  - id: d9047477-0359-48c9-b8c7-792cedcdc9c4
    type: derived

What it detects

This rule flags Windows process creation events where the command line contains the ' runassystem ' string, indicating use of NirCmd to execute commands in the LocalSystem context. Attackers can leverage this capability to elevate execution privileges and run actions with high authority. The detection relies on process creation telemetry and the recorded command line content.

Known false positives

Legitimate use by administrators

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.