Although this tool has legitimate use cases within the context of system administration, you’d probably want to know about if it was on your network.

This rule will find NirSoft’s LSA Secrets View utility: https://www.nirsoft.net/utils/lsa_secrets_view.html

rule nirsoft_lsasecretsview
{
	meta:
		description = "NirSoft LSA Secrets View"
		reference = "https://www.nirsoft.net/utils/lsa_secrets_view.html"

	strings:
		$ = "NirSoft" wide
		$ = "LSA Secrets Viewer" wide

	condition:
		uint16(0) == 0x5a4d and all of them
}

YARA Rules Index