NullsoftInstallSystemv20a0

Hunt Hypothesis

This rule detects the presence of the Nullsoft Install System (NSIS) executable, which adversaries frequently leverage to package and deploy malicious payloads or establish persistence through custom installers. Proactively hunting for this artifact allows the SOC team to identify potential supply chain compromises or unauthorized software installations that may be used to execute post-exploitation actions within the Azure environment.

YARA Rule

rule NullsoftInstallSystemv20a0
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Based on the rule title NullsoftInstallSystemv20a0, this detection targets the Nullsoft Install System (NSIS) installer executable, specifically version 2.0a0. This version is quite old (released around 2007–2008) and is frequently embedded in legacy software installers or used by specific third-party tools. Because NSIS is a standard installer framework, legitimate software often bundles it.

Here are 3–5 specific false positive scenarios and suggested filters:

• Legacy Java or .NET Framework Updates: Older versions of Java (e.g., Java 6/7) or .NET Framework 2.0/3.5 installers often use NSIS 2.0a0. These may be triggered by scheduled maintenance jobs or manual admin updates on older servers.

  • Filter/Exclusion: Exclude processes where the parent process is msiexec.exe or wuaclt.exe (Windows Update Agent), or filter by known legacy installer paths like C:\Program Files\Java\jre6\bin\ or C:\Windows\Microsoft.NET\Framework\v2.0.50727\.

• Adobe Reader/Acrobat Legacy Installers: Older versions of Adobe Reader (pre-2010) or Acrobat use NSIS installers. These may be invoked during patch cycles or by IT admins deploying legacy PDF tools to specific departments.

  • Filter/Exclusion: Exclude if the executable path contains Adobe or Reader and the parent process is msiexec.exe or a known Adobe update service (AdobeUpdateService).

• VMware Tools or VirtualBox Guest Additions: Some older versions of VMware Tools or VirtualBox guest additions use NSIS-based installers. These are commonly installed by hypervisor management tools or during VM provisioning.

  • *Filter/Ex