All Detections

PUA - NirCmd Execution

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202508

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

Sigma