{
  "family": "nssm",
  "sample_count": 15,
  "category": "hacktool",
  "description": "NSSM (Non-Sucking Service Manager, classified across antimalware engines as HackTool:Win32/NSSM, Tool:Win32/NSSM, and PUA:Win32/NSSM) is a legitimate service wrapper utility heavily abused and weaponized by threat actors and ransomware cartels (including Conti, LockBit, BlackCat/ALPHV, and Hive). Threat actors drop nssm.exe into %TEMP% or %SystemRoot% during lateral movement and intrusion operations to convert arbitrary malicious scripts, batch files, proxy utilities, and ransomware binaries into fully managed Windows background services running under NT AUTHORITY\\SYSTEM context. By executing through NSSM, malicious payloads survive user logoffs, automatically restart upon crash, and blend in with routine administrative service activity, complicating detection by endpoint security solutions.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/NSSM",
    "Tool:Win32/NSSM",
    "PUA:Win32/NSSM",
    "Non-Sucking Service Manager",
    "Win32/NSSM"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/NSSM?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NSSM is a service wrapper tool frequently weaponized by ransomware cartels to run malicious payloads as persistent Windows services."
      }
    },
    {
      "@type": "Question",
      "name": "Why do ransomware operators abuse NSSM?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It easily converts arbitrary scripts or executables into SYSTEM-level services with automatic restart capabilities on failure."
      }
    },
    {
      "@type": "Question",
      "name": "Which ransomware gangs have been observed abusing NSSM?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Conti, LockBit, BlackCat (ALPHV), and Hive operators have frequently used NSSM during lateral movement and deployment phases."
      }
    },
    {
      "@type": "Question",
      "name": "Where do attackers commonly stage nssm.exe?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In writable directories such as %TEMP%, %APPDATA%, C:\\Windows\\Temp, or %ProgramData% under disguised binary names."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect malicious NSSM activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor Windows event logs for service creation events (Event ID 7045) referencing nssm.exe and alert on unusual service paths."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1543.003",
    "T1569.002",
    "T1059.003",
    "T1078.002",
    "T1036.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Watchdog)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1078",
      "name": "Valid Accounts (Required for installation)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the presence of an unauthorized NSSM service indicates an attacker has already achieved administrative access.",
    "Use the `sc stop [ServiceName]` and `sc delete [ServiceName]` commands (or NSSM itself) to halt and remove the persistence mechanism before attempting to delete the malicious payload.",
    "Analyze the command-line arguments passed to `nssm.exe` (using EDR logs) to identify exactly which malicious payload it was configured to launch.",
    "Assume the local administrator credentials have been compromised and initiate enterprise-wide password resets."
  ],
  "what_to_avoid": [
    "Do not simply try to kill the malicious payload process via Task Manager; the NSSM watchdog service will immediately restart it.",
    "Avoid relying solely on file hashes to detect NSSM, as attackers often rename the executable (e.g., `svchost.exe`) or recompile the open-source code to change the hash."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - HackTool:Win32/NSSM",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/NSSM"
    },
    {
      "name": "CISA Alert (AA22-040A) - Conti Ransomware Advisory",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-040a"
    },
    {
      "name": "MITRE ATT&CK - Create or Modify System Process: Windows Service (T1543.003)",
      "url": "https://attack.mitre.org/techniques/T1543/003/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}