{
  "family": "nssm",
  "sample_count": 15,
  "category": "ransomware",
  "description": "HackTool:Win32/Nssm is a critical classification highlighting the malicious abuse of the **Non-Sucking Service Manager (NSSM)**. While NSSM is a legitimate, open-source utility designed to allow administrators to run any standard executable or script as a Windows Service, it has become a staple tool for ransomware operators (like Conti and LockBit) and Advanced Persistent Threats (APTs) to establish robust, highly resilient persistence.<br><br><b>Understanding the Abuse of NSSM</b><br>To a standard user, the execution of NSSM is invisible. For a security analyst, detecting the unauthorized execution of `nssm.exe` is a massive red flag indicating a severe compromise. Attackers utilize NSSM because it removes the need to write custom, complex Windows Service installation code. By simply dropping `nssm.exe` (which is often digitally signed, bypassing initial AV checks) alongside their backdoor or ransomware payload, they can ensure their malware runs silently in the background with `SYSTEM` privileges, surviving reboots and user logoffs.<br><br><b>Execution and Persistence Mechanics</b><br>Attackers typically deploy NSSM during the 'Persistence' and 'Privilege Escalation' phases of the attack lifecycle, after initial access has been achieved (`T1543.003`). They execute `nssm.exe` via the command line (`T1059.003`), providing the path to their malicious payload (e.g., a Cobalt Strike beacon, a miner, or a ransomware encryptor). NSSM installs the payload as a Windows Service, configuring it to start automatically. Crucially, NSSM features robust service monitoring; if the AV or a defender attempts to terminate the malicious payload, the NSSM service will instantly restart it, providing a watchdog function that makes manual remediation exceedingly difficult.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme persistence for high-level malware operating with `SYSTEM` privileges. Incident responders should immediately investigate any EDR alerts indicating the execution of `nssm.exe`, especially if it originates from temporary directories (`%Temp%`, `C:\\PerfLogs`) rather than standard administrative folders. Command-line logs showing `nssm install [ServiceName]` are definitive IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1036.005",
    "T1078",
    "T1059.003",
    "T1562.001",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Watchdog)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1078",
      "name": "Valid Accounts (Required for installation)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the presence of an unauthorized NSSM service indicates an attacker has already achieved administrative access.",
    "Use the `sc stop [ServiceName]` and `sc delete [ServiceName]` commands (or NSSM itself) to halt and remove the persistence mechanism before attempting to delete the malicious payload.",
    "Analyze the command-line arguments passed to `nssm.exe` (using EDR logs) to identify exactly which malicious payload it was configured to launch.",
    "Assume the local administrator credentials have been compromised and initiate enterprise-wide password resets."
  ],
  "what_to_avoid": [
    "Do not simply try to kill the malicious payload process via Task Manager; the NSSM watchdog service will immediately restart it.",
    "Avoid relying solely on file hashes to detect NSSM, as attackers often rename the executable (e.g., `svchost.exe`) or recompile the open-source code to change the hash."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}