NirCmd Execution with Suspicious Parameters
Detects the execution of NirCmd, a legitimate command-line utility, when used with specific command-line arguments that indicate execution of other commands or scripts. This could be indicative of an adversary using NirCmd for execution, potentially to hide windows or run commands with specific privileges.
Sigma
