NirCmd
- Related IoCs
- 30 (18 malicious)
- Last IoC activity
- 2026-10-16 01:41:37
- Profile updated
- 2026-07-07 15:13:43
Context
NirCmd is a benign tool by NirSoft that provides various functionalities. Among these is e.g. a capability to start regedit as SYSTEM, which is sometimes abused for privilege escalation, or other functionality abusable for other malicious purposes. It is also frequently flagged by AV engines.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Nircmd (report)
- nirsoft.net — Nircmd (report)