Unfortunately, NirSoft tools are abused by malicious entities, often bundled with malware or purposefully placed on compromised systems to glean additional information. Attackers abuse these tools to dump passwords from browsers, email clients, and those held within the registry.

As such, the presence of NirSoft tools on a system is noteworthy. Hits on this rule often yield false-positive results but may reveal malicious activity.

This rule is generic and future-proof because it will almost certainly match additional tools developed by NirSoft that haven’t been released yet.

rule nirsoft_generic
{
	meta:
		description = "Generic catch-all for NirSoft tools"

	strings:
		$ = "NirSoft" ascii wide

	condition:
		all of them
}

YARA Rules Index