NSISInstallerNullSoft

Hunt Hypothesis

This detection identifies the execution of Nullsoft’s NSIS installer, a common legitimate tool frequently leveraged by adversaries to package and deploy malicious payloads during the initial stages of an attack. Proactive hunting for this behavior in Azure Sentinel is essential to distinguish between routine software installations and potential supply chain compromises or fileless attacks that utilize standard installers to evade signature-based defenses.

YARA Rule

rule NSISInstallerNullSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 [4] C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 [4] 68 [4] A3 [4] E8 [4] BE }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NSISInstallerNullSoft detection rule in an enterprise environment, along with targeted filters and exclusions:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management (SCCM) or Microsoft Intune pushes standard software packages (e.g., Adobe Reader, Zoom, 7-Zip) to endpoints. These packages often utilize the Nullsoft NSIS engine for silent installation (/S or /VERYSILENT flags), triggering the rule on every deployment cycle across hundreds of machines.
  • Filter/Exclusion: Create a whitelist based on the CommandLine argument containing specific silent install switches (e.g., * /S, * /VERYSILENT) and restrict the scope to known distribution point accounts (e.g., DOMAIN\SCCM-Admin). Alternatively, exclude file paths located within the standard deployment cache directory: C:\Windows\CCMCache\*\*.exe.

• Scenario: Scheduled Maintenance Jobs for Legacy Applications

  • Context: A legacy internal application (e.g., a proprietary HR portal or specialized CAD tool) runs a nightly scheduled task to self-update its runtime components. This task executes an NSIS-based installer in the background without user interaction, mimicking a manual installation event.
  • Filter/Exclusion: Implement a rule exclusion based on the Process Name and Parent Process. Exclude events where the parent process is Task Scheduler (svchost.exe) or specific service accounts running under SYSTEM, provided the executable path matches the known legacy application directory (e.g., C:\Program Files\LegacyHR\Updates\).

• Scenario: Endpoint Protection Agent Self-Update

  • Context: The organization’s primary endpoint security suite (e.g., CrowdStrike, Carbon Black, or