Detects the use of NirCmd tool for command execution as SYSTEM user
Read the full analysis on IntelFusions