HackTool:Win32/NirCmd!AMTB - Windows Defender Threat Analysis

This threat, HackTool:Win32/NirCmd!AMTB, is a concrete detection of a hack tool package. It bundles utilities like NirCmd, NSudoLG (a privilege escalation tool), and 7z.exe, often used for system manipulation, UAC bypass, or other unauthorized activities by attackers.

No specific strings found for this threat

rule HackTool_Win32_NirCmd_AMTB_2147957491_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "HackTool:Win32/NirCmd!AMTB"
        threat_id = "2147957491"
        type = "HackTool"
        platform = "Win32: Windows 32-bit platform"
        family = "NirCmd"
        severity = "High"
        signature_type = "SIGNATURE_TYPE_PEHSTR_EXT"
        threshold = "5"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "saked/NSudoLG.exe" ascii //weight: 1
        $x_1_2 = "saked/nircmd.exe" ascii //weight: 1
        $x_1_3 = "saked/cecho.exe" ascii //weight: 1
        $x_1_4 = "saked/same.zip" ascii //weight: 1
        $x_1_5 = "saked/7z.exe" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}

Immediately isolate the affected system, perform a full system scan with updated antivirus software to remove the detected files, and investigate for any signs of compromise, privilege escalation, or further malicious activity using EDR/SIEM tools. Review system logs and user accounts for unauthorized changes.