Renamed NirCmd.EXE Execution
Detects the execution of a renamed "NirCmd.exe" binary based on its original filename metadata. This rule specifically looks for instances where the 'OriginalFileName' field in the process creation event is 'NirCmd.exe', but the actual executed image path does not end with 'nircmd.exe' or 'nircmdc.exe'. This indicates an attempt to evade detection by renaming the legitimate NirCmd utility.
Sigma
