NullsoftInstallSystemv20b2v20b3

Hunt Hypothesis

This rule identifies the presence of Nullsoft Install System (NSIS) executable files, which are commonly used by adversaries to package and execute malicious payloads during initial access or lateral movement. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to detect potential supply chain compromises or unauthorized installer deployments that may bypass standard application whitelisting controls.

YARA Rule

rule NullsoftInstallSystemv20b2v20b3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 [3] 00 57 FF 15 [2] 40 00 57 FF 15 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Standard software deployment via Group Policy Objects (GPO) or SCCM/Intune using NSIS-based installers (e.g., Adobe Reader, Java JRE, or internal line-of-business apps).
  • Filter/Exclusion: Exclude processes where the parent is gpupdate.exe, ccmsetup.exe, IntuneAgent.exe, or msiexec.exe with specific service arguments, or filter by known trusted publisher names (e.g., “Adobe Systems”, “Oracle Corporation”) in the file metadata.
• Scenario: Automated patching or maintenance scripts executed by scheduled tasks that download and run NSIS installers for dependencies (e.g., .NET Framework updates, Visual C++ Redistributables).
  • Filter/Exclusion: Exclude executions where the command line contains standard NSIS installer flags like /S (silent) or /passive, and the working directory is a known temp or patch folder (e.g., C:\Windows\Temp, C:\ProgramData\Microsoft\UpdateOrchestrator).
• Scenario: Development or QA teams manually installing testing tools or SDKs (e.g., Python, Node.js, Git for Windows) using NSIS installers during onboarding or environment setup.
  • Filter/Exclusion: Exclude processes initiated by user accounts belonging to specific AD security groups (e.g., Dev-Team, QA-Staff) or where the installer path matches known development tool directories (e.g., C:\Users\<User>\Downloads, C:\Tools).
• Scenario: Endpoint Detection and Response (EDR) or backup agents performing integrity checks or restoring files that include NSIS-based application binaries.
  • Filter/Exclusion: Exclude events where the parent process is an EDR/backup agent (e.g., CrowdStrike Falcon, `Carbon