Nircmd

Overview

HackTool:Win32/Nircmd refers to the detection of a perfectly legitimate, highly powerful system administration utility created by NirSoft. Because NirCmd allows for deep system manipulation (editing registry keys, interacting with services, hiding windows, executing commands) directly from the command line without any GUI prompts, it is heavily weaponized by threat actors as a 'Living off the Land' (LotL) execution tool (`T1218`).

Understanding Nircmd (Weaponized Utilities)
To an end-user, execution is completely invisible. For a SOC analyst, detecting `nircmd.exe` on a workstation (unless specifically deployed by IT) is a major red flag. Attackers drop this tool alongside their malware to perform complex administrative tasks silently, leveraging the fact that `nircmd.exe` is often digitally signed or trusted by less-strict AV policies.

Execution and Evasion Mechanics
Attackers frequently rename `nircmd.exe` (e.g., to `svchost.exe` or `update.exe`) and place it in a hidden folder. They then use it in batch scripts or scheduled tasks. For example, an attacker might use `nircmd.exe exec hide payload.exe` to run a ransomware encryptor completely hidden from the user's desktop (`T1564.003`), or `nircmd.exe service stop WinDefend` to disable security services (`T1562.001`).

Indicators of Compromise & Impact
The impact depends on the command executed by NirCmd. Host-based IoCs rely heavily on EDR command-line logging. Look for the execution of a binary with the original filename of `nircmd.exe` (or matching its hash), specifically focusing on the arguments passed to it (e.g., `hide`, `service`, `regsetval`). The presence of `nircmd.exe` in temporary directories (`%Temp%`, `%AppData%`) is highly anomalous.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_NIRCMD {
    meta:
        description = "Detects Nircmd (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "nircmd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Nircmd Activity
id: fa87d91e70c7a36bb46b4a2ec4d9d80a
status: experimental
description: Detects generic indicators of the nircmd malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*nircmd*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Review EDR logs to determine the exact command-line arguments passed to `nircmd.exe` to understand what the attacker accomplished.
2. If NirCmd was used to hide the execution of a secondary payload, identify and isolate that payload immediately.
3. Check for scheduled tasks or registry run keys that are utilizing NirCmd for persistent execution.
4. Implement Application Control (AppLocker) policies to explicitly block the execution of `nircmd.exe` and its known hashes across the enterprise.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the alert because NirCmd is a 'known good' IT tool; in the hands of an attacker, it is a weapon.
2. Avoid deleting the NirCmd executable without first recording its command-line history.

References & External Analysis

• Search "nircmd" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Packy
• Pcclean
• Jakuz
• Ruandmel
• Scarab

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/nircmd.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.