Detection rules › Sigma

PUA - NirCmd Execution As LOCAL SYSTEM

Severity
high
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects the use of NirCmd tool for command execution as SYSTEM user

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1569.002 System Services: Service Execution

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

CommandLine|contains: ' runassystem '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • runassystem