Renamed NirCmd.EXE Execution

Rule Info

Name
Renamed NirCmd.EXE Execution
Author
X__Junior (Nextron Systems)
Description
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Reference
https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Date
2024-03-11 00:00:00
Modified
None
Id
264982dc-dbad-4dce-b707-1e0d3e0f73d9
Tags
attack.execution attack.t1059 attack.defense-evasion attack.t1202
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=264982dc-dbad-4dce-b707-1e0d3e0f73d9

Rule History

Author
Title
Date
Commit
github-actions[bot]
Merge PR #5177 from @nasbench - promote older rules status from `experimental` to `test`
2025-02-03
2bfb0935a
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
Mohamed Ashraf
Merge PR #4760 from @X-Junior - Add new rule `Renamed NirCmd.EXE Execution`
2024-03-11
4c3eb7a2f
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022