NullsoftPiMPInstallSystemv1x

Hunt Hypothesis

This rule detects the execution of the Nullsoft PiMP installer, a component often associated with legacy or third-party software installations that may introduce unmonitored binaries into the environment. Proactively hunting for this activity allows the SOC team to identify potential supply chain risks or unauthorized software deployments that could serve as footholds for adversaries in the Azure Sentinel environment.

YARA Rule

rule NullsoftPiMPInstallSystemv1x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 56 57 FF 15 [2] 40 00 05 E8 03 00 00 BE [3] 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 [2] 40 00 50 56 FF 15 [2] 40 00 80 3D [3] 00 22 75 08 80 C3 02 BE [3] 00 8A 06 8B 3D [2] 40 00 84 C0 74 ?? 3A C3 74 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually installs or updates the Nullsoft PiMP (Packaging and Installation Management Platform) agent on a new endpoint to manage software distribution. The installation process often involves dropping a temporary installer executable (e.g., PiMPInstaller.exe or similar) into the user’s %TEMP% or %APPDATA% directory before executing it, which matches the YARA signature for the PiMP system components.

  • Filter/Exclusion: Exclude files located in specific PiMP installation directories (e.g., C:\Program Files\Nullsoft\PiMP\) or exclude processes with the name PiMPService.exe or PiMPAgent.exe if the rule triggers on the service binary rather than the installer. Additionally, exclude paths containing \Nullsoft\PiMP\ in the file path.

• Scenario: A Group Policy Object (GPO) or SCCM (System Center Configuration Manager) deployment pushes the PiMP client update to multiple machines simultaneously. The deployment mechanism (e.g., ccmsetup.exe or msiexec.exe) extracts the PiMP installer to a temporary cache folder (e.g., C:\Windows\Installer\ or %TEMP%\ccmsetup\) and executes it. The YARA rule detects the extracted installer binary in the temporary location, flagging it as a potential threat.

  • Filter/Exclusion: Exclude files whose parent process is ccmsetup.exe, msiexec.exe, or gpupdate.exe. Alternatively, exclude file paths that contain \ccmsetup\ or \Windows\Installer\ combined with a known PiMP MSI package name (e.g., PiMPClient.msi).

• Scenario: A scheduled task (e.g., PiMPDailySync or NullsoftUpdate) runs nightly to check for PiMP platform