Nullsoft Install System 1xx additional

Hunt Hypothesis

This rule identifies the presence of Nullsoft Install System (NSIS) executables, which are frequently abused by adversaries to package and deliver malicious payloads or installers. Proactively hunting for these artifacts in Azure Sentinel helps the SOC team detect potential supply chain attacks or unauthorized software deployments that may leverage common installer frameworks to establish a foothold in the environment.

YARA Rule

rule Nullsoft_Install_System_1xx_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy or SCCM: Administrators often deploy older internal tools or third-party software (e.g., legacy Java plugins, old PDF readers, or specialized engineering software) that still use the NSIS 1.x compiler. These installations are frequently pushed via Group Policy Preferences or System Center Configuration Manager (SCCM) to endpoints.
  • Filter/Exclusion: Exclude files located in standard installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) where the parent process is a known deployment agent (e.g., CcmExec.exe, GpOlv.exe, or Taskengw.exe).
• Developer Local Environment Setup: Developers on build or dev machines frequently install older versions of development tools, SDKs, or runtime libraries (e.g., older versions of .NET Framework, Python 2.x, or specific compiler toolchains) that were packaged with NSIS 1.x. These are often installed manually or via internal scripts during onboarding or environment resets.
  • Filter/Exclusion: Exclude files in user-specific directories (e.g., C:\Users\<username>\AppData\Local\, C:\Users\<username>\.nuget\, or C:\dev\) when the user account belongs to a “Developers” or “BuildAgents” security group.
• Virtual Machine Image Golden Templates: Enterprise IT teams maintain “golden images” for virtual desktops or server clusters that include a baseline set of software installed at image creation time. If the image was created several years ago, it may contain NSIS 1.x installers or installed binaries that remain on disk. These files are static and do not change behavior over time.
  • Filter/Exclusion: Exclude files where the Last Write Time is older than 180 days and the file path matches