NirCmd Execution As LOCAL SYSTEM
This rule detects the execution of NirCmd with the 'runassystem' command-line argument. NirCmd is a legitimate command-line utility that can be used to perform various tasks, including running commands as the SYSTEM user. Adversaries may abuse this functionality to execute arbitrary commands with elevated privileges, potentially for privilege escalation or to maintain persistence. The detection specifically looks for the ' runassystem ' string in the command line, indicating an attempt to execute a process with SYSTEM privileges using NirCmd.
Sigma
