NullsoftInstallSystemv198

Hunt Hypothesis

This rule identifies the execution of the Nullsoft Install System (NSIS), a common installer framework frequently leveraged by adversaries to package and deploy malicious payloads or establish persistence through standard installation routines. Proactively hunting for this activity in Azure Sentinel helps detect low-fidelity initial access or lateral movement attempts that may blend in with legitimate software deployments, ensuring that suspicious installer usage is investigated before it escalates into a full compromise.

YARA Rule

rule NullsoftInstallSystemv198
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 56 57 FF 15 2C 81 40 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Silent Installation of Legacy Enterprise Software via GPO or SCCM

  • Scenario: Group Policy Objects (GPO) or System Center Configuration Manager (SCCM) push silent installations of legacy applications (e.g., older versions of Adobe Reader, Java, or specific vendor tools) that still rely on the Nullsoft Install System (NSIS) rather than modern MSI packages. This often occurs during patch Tuesday cycles or new user provisioning.
  • Filter/Exclusion: Exclude processes where the parent is gpupdate.exe, ccmsetup.exe, or ccmexec.exe, and the command line contains flags like /S, /silent, or /quiet. Additionally, whitelist known NSIS-based installer executables (e.g., setup.exe from specific vendor paths) if they are consistently benign.

• Scheduled Maintenance Jobs for Third-Party Agents

  • Scenario: Scheduled tasks (Task Scheduler) run by service accounts to update or reinstall monitoring agents, anti-malware components, or virtualization tools (e.g., VMware Tools, Hyper-V Integration Services) that use NSIS-based installers. These jobs often run unattended and may spawn setup.exe or install.exe with NSIS characteristics.
  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically the Task Scheduler service) or taskschd.exe, and the working directory is a standard vendor-specific folder (e.g., C:\Program Files\VMware\, C:\Program Files\Hyper-V\). Whitelist specific task names known to trigger these installers.

• Developer or QA Environment Local Tooling

  • Scenario: Developers or QA engineers manually install local development tools, SDKs, or lightweight utilities (e.g., Git for Windows, Python installers, or specific CLI tools)