Nircmd

Overview

HackTool:Win32/Nircmd refers to the detection of a perfectly legitimate, highly powerful system administration utility created by NirSoft. Because NirCmd allows for deep system manipulation (editing registry keys, interacting with services, hiding windows, executing commands) directly from the command line without any GUI prompts, it is heavily weaponized by threat actors as a 'Living off the Land' (LotL) execution tool (`T1218`).

Understanding Nircmd (Weaponized Utilities)
To an end-user, execution is completely invisible. For a SOC analyst, detecting `nircmd.exe` on a workstation (unless specifically deployed by IT) is a major red flag. Attackers drop this tool alongside their malware to perform complex administrative tasks silently, leveraging the fact that `nircmd.exe` is often digitally signed or trusted by less-strict AV policies.

Execution and Evasion Mechanics
Attackers frequently rename `nircmd.exe` (e.g., to `svchost.exe` or `update.exe`) and place it in a hidden folder. They then use it in batch scripts or scheduled tasks. For example, an attacker might use `nircmd.exe exec hide payload.exe` to run a ransomware encryptor completely hidden from the user's desktop (`T1564.003`), or `nircmd.exe service stop WinDefend` to disable security services (`T1562.001`).

Indicators of Compromise & Impact
The impact depends on the command executed by NirCmd. Host-based IoCs rely heavily on EDR command-line logging. Look for the execution of a binary with the original filename of `nircmd.exe` (or matching its hash), specifically focusing on the arguments passed to it (e.g., `hide`, `service`, `regsetval`). The presence of `nircmd.exe` in temporary directories (`%Temp%`, `%AppData%`) is highly anomalous.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_NIRCMD_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nircmd"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "nircmd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Nircmd (Ransomware) Execution & Triage
id: 335ba58d-2f08-5c85-89ab-74112a6d9010
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Nircmd malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/nircmd
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1562_001
- attack.t1564_003
- attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_NIRCMD_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nircmd tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "nircmd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Review EDR logs to determine the exact command-line arguments passed to `nircmd.exe` to understand what the attacker accomplished.
2. If NirCmd was used to hide the execution of a secondary payload, identify and isolate that payload immediately.
3. Check for scheduled tasks or registry run keys that are utilizing NirCmd for persistent execution.
4. Implement Application Control (AppLocker) policies to explicitly block the execution of `nircmd.exe` and its known hashes across the enterprise.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the alert because NirCmd is a 'known good' IT tool; in the hands of an attacker, it is a weapon.
2. Avoid deleting the NirCmd executable without first recording its command-line history.

References & External Analysis

• Search "nircmd" on VirusTotal (External Analysis)
• Search "nircmd" on Any.Run (Sandbox Sandbox)
• Search "nircmd" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Avkiller
• Davobevix
• Slefdel
• Genericrxfp
• Antavmu
• Chinbo
• Ruby
• Genericrxcd

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/nircmd.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.