Detection rules › Splunk
NirCmd Execution (Sysmon)
NirCmd is a command line utility with capabilities to delete files from Recycling Bin, delete registry keys, take screenshots and execute command without displaying a user interface. While it has legitimate administrative uses, threat actors including Mint Sandstorm aka PHOSPHORUS have been observed using renamed NirCmd to execute malicious code. This use case detects executions of NirCmd.exe or command line argument patterns consistent with abusive activities observed with NirCmd, accounting for instances where it has been renamed. Allowlisting is recommended for executables using the same command line arguments for best results.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059 Command and Scripting Interpreter |
| Stealth | T1070 Indicator Removal |
| Collection | T1113 Screen Capture |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '27585.50195'
title: NirCmd Execution
description: 'NirCmd is a command line utility with capabilities to delete files from
Recycling Bin, delete registry keys, take screenshots and execute command without
displaying a user interface. While it has legitimate administrative uses, threat
actors including Mint Sandstorm aka PHOSPHORUS have been observed using renamed
NirCmd to execute malicious code. This use case detects executions of NirCmd.exe
or command line argument patterns consistent with abusive activities observed with
NirCmd, accounting for instances where it has been renamed. Allowlisting is recommended
for executables using the same command line arguments for best results. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"NirCmd" OR ((" execmd " OR ".exe script " OR ".exe shexec " OR " runinteractive
" OR " runinteractivecmd " OR " savescreenshot " OR " savescreenshotfull " OR "savescreenshotwin
" OR " regdelval " OR " regdelkey " OR " regsetval ") OR ((" exec " OR " exec2 ")
(" show " OR " hide "))) | where match(process_name, "(?i)nircmd\.exe") or match(process,
"(?i)\s(execcmd|runinteractive(cmd)?|savescreenshot(full|win)?|regdel(val|key)|regsetval|exec2?\s+(show|hide))\s|\.exe\s+(script|shexec)")
| table _time, host, user, process, parent_process_name, process_* | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- collection:screen capture
- execution:command and scripting interpreter
- defense-evasion:indicator removal
technique_id:
- T1113
- T1059
- T1070
data_category:
- Windows Sysmon
references:
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
- https://asec.ahnlab.com/ko/45153/
- https://nircmd.nirsoft.net/
- https://www.nirsoft.net/utils/nircmd.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "NirCmd" OR ((" execmd " OR ".exe script " OR ".exe shexec " OR " runinteractive " OR " runinteractivecmd " OR " savescreenshot " OR " savescreenshotfull " OR "savescreenshotwin " OR " regdelval " OR " regdelkey " OR " regsetval ") OR ((" exec " OR " exec2 ") (" show " OR " hide ")))
Stage 2: where
| where match(process_name, "(?i)nircmd\.exe") or match(process, "(?i)\s(execcmd|runinteractive(cmd)?|savescreenshot(full|win)?|regdel(val|key)|regsetval|exec2?\s+(show|hide))\s|\.exe\s+(script|shexec)")
Stage 3: table
| table _time, host, user, process, parent_process_name, process_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process | match |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "NirCmd" |
| 1 | " execmd " |
| 1 | ".exe script " |
| 1 | ".exe shexec " |
| 1 | " runinteractive " |
| 1 | " runinteractivecmd " |
| 1 | " savescreenshot " |
| 1 | " savescreenshotfull " |
| 1 | "savescreenshotwin " |
| 1 | " regdelval " |
| 1 | " regdelkey " |
| 1 | " regsetval " |
| 1 | " exec " |
| 1 | " exec2 " |
| 1 | " show " |
| 1 | " hide " |