{
  "family": "nircmd",
  "sample_count": 1,
  "category": "ransomware",
  "description": "HackTool:Win32/Nircmd refers to the detection of a perfectly legitimate, highly powerful system administration utility created by NirSoft. Because NirCmd allows for deep system manipulation (editing registry keys, interacting with services, hiding windows, executing commands) directly from the command line without any GUI prompts, it is heavily weaponized by threat actors as a 'Living off the Land' (LotL) execution tool (`T1218`).<br><br><b>Understanding Nircmd (Weaponized Utilities)</b><br>To an end-user, execution is completely invisible. For a SOC analyst, detecting `nircmd.exe` on a workstation (unless specifically deployed by IT) is a major red flag. Attackers drop this tool alongside their malware to perform complex administrative tasks silently, leveraging the fact that `nircmd.exe` is often digitally signed or trusted by less-strict AV policies.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers frequently rename `nircmd.exe` (e.g., to `svchost.exe` or `update.exe`) and place it in a hidden folder. They then use it in batch scripts or scheduled tasks. For example, an attacker might use `nircmd.exe exec hide payload.exe` to run a ransomware encryptor completely hidden from the user's desktop (`T1564.003`), or `nircmd.exe service stop WinDefend` to disable security services (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the command executed by NirCmd. Host-based IoCs rely heavily on EDR command-line logging. Look for the execution of a binary with the original filename of `nircmd.exe` (or matching its hash), specifically focusing on the arguments passed to it (e.g., `hide`, `service`, `regsetval`). The presence of `nircmd.exe` in temporary directories (`%Temp%`, `%AppData%`) is highly anomalous.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1564.003",
    "T1218"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1218",
      "name": "System Binary Proxy Execution (Abusing a legitimate tool to execute malicious actions)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1564.003",
      "name": "Hide Artifacts: Hidden Window (Using NirCmd's 'exec hide' feature)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Using NirCmd to stop security services)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Review EDR logs to determine the exact command-line arguments passed to `nircmd.exe` to understand what the attacker accomplished.",
    "If NirCmd was used to hide the execution of a secondary payload, identify and isolate that payload immediately.",
    "Check for scheduled tasks or registry run keys that are utilizing NirCmd for persistent execution.",
    "Implement Application Control (AppLocker) policies to explicitly block the execution of `nircmd.exe` and its known hashes across the enterprise."
  ],
  "what_to_avoid": [
    "Do not ignore the alert because NirCmd is a 'known good' IT tool; in the hands of an attacker, it is a weapon.",
    "Avoid deleting the NirCmd executable without first recording its command-line history."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}