NullsoftInstallSystemv20RC2

Hunt Hypothesis

This hypothesis targets the presence of the NSIS (Nullsoft Scriptable Install System) installer framework, which adversaries frequently leverage to package and execute malicious payloads or establish persistence through custom installation scripts. Proactively hunting for this artifact in Azure Sentinel helps identify potential supply chain compromises or unauthorized software deployments that may bypass standard application whitelisting controls.

YARA Rule

rule NullsoftInstallSystemv20RC2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legacy application deployment via Group Policy Objects (GPO) or SCCM using NSIS-based installers (e.g., older versions of Adobe Reader, Java Runtime, or internal line-of-business tools).
  • Filter/Exclusion: Exclude processes where the parent process is gpupdate.exe, ccmexec.exe (SCCM), or svchost.exe (if running under a specific service), and the image path resides in standard deployment directories like C:\Windows\Temp\ or C:\ProgramData\Microsoft\Windows\WER\.
• Scenario: Automated software updates for developer tools or IDEs that use NSIS for their update mechanism (e.g., older versions of Visual Studio Code, JetBrains IDEs, or Python package managers like pip when installing C-extension dependencies).
  • Filter/Exclusion: Exclude if the parent process is a known development tool binary (e.g., code.exe, idea64.exe, python.exe) or if the working directory contains node_modules, .venv, or site-packages.
• Scenario: Scheduled maintenance jobs or service health checks that re-verify or repair NSIS-installed components (e.g., Windows Update cleanup tasks, or custom PowerShell scripts running msiexec or direct installer calls during off-hours).
  • Filter/Exclusion: Exclude if the process is spawned by Task Scheduler (taskschd.exe) or svchost.exe (DcomLaunch) and the command line contains keywords like /repair, /verify, or /uninstall, or if the timestamp aligns with known scheduled task windows.
• Scenario: End-user installation of portable or lightweight utilities that use NSIS (e.g., 7-Zip, WinRAR, or internal IT helpdesk tools) from a network share or USB drive.