{
  "family": "nircmd",
  "sample_count": 1,
  "category": "ransomware",
  "description": "HackTool:Win32/Nircmd refers to the detection of a perfectly legitimate, highly powerful system administration utility created by NirSoft. Because NirCmd allows for deep system manipulation (editing registry keys, interacting with services, hiding windows, executing commands) directly from the command line without any GUI prompts, it is heavily weaponized by threat actors as a 'Living off the Land' (LotL) execution tool (`T1218`).<br><br><b>Understanding Nircmd (Weaponized Utilities)</b><br>To an end-user, execution is completely invisible. For a SOC analyst, detecting `nircmd.exe` on a workstation (unless specifically deployed by IT) is a major red flag. Attackers drop this tool alongside their malware to perform complex administrative tasks silently, leveraging the fact that `nircmd.exe` is often digitally signed or trusted by less-strict AV policies.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers frequently rename `nircmd.exe` (e.g., to `svchost.exe` or `update.exe`) and place it in a hidden folder. They then use it in batch scripts or scheduled tasks. For example, an attacker might use `nircmd.exe exec hide payload.exe` to run a ransomware encryptor completely hidden from the user's desktop (`T1564.003`), or `nircmd.exe service stop WinDefend` to disable security services (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the command executed by NirCmd. Host-based IoCs rely heavily on EDR command-line logging. Look for the execution of a binary with the original filename of `nircmd.exe` (or matching its hash), specifically focusing on the arguments passed to it (e.g., `hide`, `service`, `regsetval`). The presence of `nircmd.exe` in temporary directories (`%Temp%`, `%AppData%`) is highly anomalous.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Nircmd and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nircmd is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Nircmd establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nircmd typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Nircmd compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Nircmd should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Nircmd employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nircmd typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Nircmd, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Nircmd depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.001",
    "T1564.003",
    "T1218"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1218",
      "name": "System Binary Proxy Execution (Abusing a legitimate tool to execute malicious actions)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1564.003",
      "name": "Hide Artifacts: Hidden Window (Using NirCmd's 'exec hide' feature)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Using NirCmd to stop security services)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Review EDR logs to determine the exact command-line arguments passed to `nircmd.exe` to understand what the attacker accomplished.",
    "If NirCmd was used to hide the execution of a secondary payload, identify and isolate that payload immediately.",
    "Check for scheduled tasks or registry run keys that are utilizing NirCmd for persistent execution.",
    "Implement Application Control (AppLocker) policies to explicitly block the execution of `nircmd.exe` and its known hashes across the enterprise."
  ],
  "what_to_avoid": [
    "Do not ignore the alert because NirCmd is a 'known good' IT tool; in the hands of an attacker, it is a weapon.",
    "Avoid deleting the NirCmd executable without first recording its command-line history."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}