NullsoftInstallSystemv20

Hunt Hypothesis

This rule detects the presence of Nullsoft installer components, which adversaries may leverage to stage payloads or execute scripts during the initial access or execution phases. Proactively hunting for these artifacts allows the SOC team to identify potential supply chain compromises or unauthorized software installations that could serve as footholds for further lateral movement within the Azure environment.

YARA Rule

rule NullsoftInstallSystemv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the NSIS.exe (Nullsoft Scriptable Install System) compiler or installer during software deployment via SCCM (System Center Configuration Manager) or Intune. This is a common vector for pushing updates to client machines.
  • Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe (SCCM Agent) or MsMpEng.exe (if triggered by Defender scanning/installing updates), or filter by image path containing \Program Files\Microsoft Configuration Manager\.
• Scenario: Legitimate application installations using NSIS-based installers (e.g., Adobe Creative Cloud, 7-Zip, or various Java JRE/JDK installers) executed by IT administrators or automated GPO scripts.
  • Filter/Exclusion: Exclude based on known benign parent processes such as cmd.exe or powershell.exe when the working directory is a standard administrative share (e.g., \\server\share$\) or when the executable path matches a whitelist of known NSIS-based applications (e.g., C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CCLM\).
• Scenario: Scheduled maintenance tasks or service restarts that trigger the re-initialization of NSIS-based services or components, often seen in environments with legacy software dependencies.
  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (specifically those hosting the AppMgmt or WSearch services) or taskeng.exe (Task Scheduler Engine), indicating a system-driven rather than user-initiated action.
• Scenario: Development or QA environments where developers manually compile NSIS scripts or run test installers from local development drives.
  • Filter/Exclusion: Exclude based on user group membership (e.g., DevTeam or `QA_A