Security is not a set-it-and-forget-it task. Organizations should use tools like BloodHound or specialized Endpoint Detection and Response (EDR) agents to routinely audit Modify and Full Control permissions across all application directories.
When the service restarts, NSSM executes the malicious payload as SYSTEM . Mechanism B: Registry Permission Abuse
Consider deploying application whitelisting (e.g., Windows Defender Application Control or AppLocker) to allow only signed or trusted binaries to execute. This can prevent a malicious replacement of nssm.exe from ever running, even if the file is replaced.
Updated for 2025 – because legacy vulnerabilities never truly expire. nssm224 privilege escalation updated
If you identify an NSSM service, check if your current user context can modify its registry parameters. The accesschk tool from Sysinternals is perfect for this:
When using nssm install [servicename] via command line, ensure the path provided in the GUI or CLI is explicitly quoted. Conclusion
where /r C:\ nssm.exe icacls "C:\Program Files\SomeVendor\nssm.exe" Security is not a set-it-and-forget-it task
Final notes
Ensure that the directory containing the service binary ( nssm.exe ) and the target application is not writable by the Users group. Only Administrators or SYSTEM should have write access.
wmic service get name,displayname,pathname,startmode | findstr /i "nssm" Use code with caution. If you identify an NSSM service, check if
The user might rename the legitimate application executable to app_orig.exe .
Disclaimer: This information is for educational and authorized penetration testing purposes only. Step 1: Enumeration
While NSSM helps manage services, if the path to the service executable contains spaces and is not enclosed in quotes, Windows may attempt to execute files in the parent directories (e.g., C:\Program.exe instead of C:\Program Files\Service\svc.exe ).
Use AccessChk (from the Sysinternals suite) to verify registry security: accesschk.exe -kv "HKLM\SYSTEM\CurrentControlSet\Services" Use code with caution.
Alternatively, you can manually inspect common deployment paths like C:\Program Files\ , C:\nssm\ , or custom application directories. Step 2: Checking for Weak Registry Permissions