PUA - NirCmd Execution As LOCAL SYSTEM

Title: PUA - NirCmd Execution As LOCAL SYSTEM
Status: test
Description:Detects the use of NirCmd tool for command execution as SYSTEM user
References:
  -https://www.nirsoft.net/utils/nircmd.html
  -https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
  -https://www.nirsoft.net/utils/nircmd2.html#using
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-24
modified:2023-02-13
Tags:

• -'attack.execution'
• -'attack.t1569.002'
• -'attack.s0029'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains: ' runassystem '
  condition:selection
Falsepositives:
  -Legitimate use by administrators
Level: high