NullsoftPIMPInstallSystemv13x

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the Nullsoft PIMP installer to execute legitimate-looking payloads that may serve as a precursor for lateral movement or persistence within the environment. Proactively hunting for this activity in Azure Sentinel is essential because low-severity installation events often mask initial access attempts, allowing threat actors to establish a foothold before triggering higher-fidelity alerts.

YARA Rule

rule NullsoftPIMPInstallSystemv13x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC [2] 00 00 56 57 6A ?? BE [4] 59 8D BD }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NullsoftPIMPInstallSystemv13x detection rule, along with recommended filters and exclusions:

• Scenario: Scheduled Patch Deployment via SCCM/Intune

  • Context: Enterprise IT teams frequently use Microsoft Endpoint Configuration Manager (SCCM) or Intune to push software updates. When deploying applications packaged in an NSIS installer (common for tools like Chrome, Zoom, or Adobe Reader), the PIMPInstallSystemv13x process is often invoked by the background service to handle the installation logic during off-hours maintenance windows.
  • Filter/Exclusion: Create a whitelist based on the parent process name and user context. Exclude alerts where the parent process is ccmexec.exe (SCCM) or Microsoft.Intune.ManagementAgent.exe running under the SYSTEM account or a specific service account (e.g., DOMAIN\svc-patch).

• Scenario: Automated Onboarding Scripts for New Hires

  • Context: During the provisioning of new workstations, IT automation scripts (often written in PowerShell and executed via Group Policy) trigger mass installations of standard productivity suites. These scripts invoke NSIS installers to deploy software like Microsoft Office or Slack without user interaction, triggering the detection rule as a background system event rather than suspicious user activity.
  • Filter/Exclusion: Implement a time-based exclusion for alerts occurring within 24 hours of a device’s “First Boot” timestamp or during specific maintenance windows (e.g., Sunday 02:00–06:00 UTC). Additionally, filter by the command line argument containing keywords like /S (silent) or --unattended.

• Scenario: Third-Party Antivirus or EDR Self-Upgrades

  • Context: Security suites such as CrowdStrike Falcon, Sentinel