Field Notes: NSSM - the Non-Sucking Service Manager

What it is

A DFIR field note from dfir.ch on hunting NSSM (Non-Sucking Service Manager) abuse. In the case described, attackers used nssm.exe to run ngrok as a persistent Windows service backdoor; a second example shows a service named komari-agent. NSSM is legitimate software, so detection hinges on knowing where it hides the real payload.

How it works

NSSM wraps an arbitrary executable as a Windows service and lets the operator name the service freely. It monitors the wrapped process and restarts it on crash or reboot (resilience), and it avoids Run keys and Startup folders (stealthier persistence). The key evasion detail: the service's top-level ImagePath points at nssm.exe — the actual payload path and arguments live under the Parameters subkey of the service registry key, not in ImagePath.

What to do

The post gives three concrete hunting steps:

• Event Log (Event ID 7045 — "A service was installed"). The log will not name the payload; the ImagePath field points to nssm.exe. Treat NSSM appearing in an unexpected or user-writable directory as a red flag.
• Registry. For any suspicious service (or NSSM seen in Autoruns), do not stop at ImagePath. Navigate to the service's Parameters subkey — NSSM stores the real Application, AppDirectory, and AppParameters there. Example (komari-agent): ImagePath = C:\WINDOWS\nssm.exe, running as LocalSystem, while Parameters reveals Application = C:\Program Files\Komari\komari-agent.exe with AppParameters -e http://45[..]:60773 -t b8yT[..].
• Live process analysis. Inspect command lines with Process Explorer or Velociraptor's Windows.System.Pslist. For ngrok specifically, a config= parameter pointing to an external config file is a giveaway.

Escalate priority when you see: unexpected/user-writable install paths, tunnel tooling (ngrok), or unknown service names.

flowchart TD
    A[Service in Autoruns / EID 7045] --> B{ImagePath = nssm.exe?}
    B -->|No| C[Normal triage]
    B -->|Yes| D[Do NOT stop at ImagePath]
    D --> E[Read Parameters subkey]
    E --> F[Real Application + AppParameters]
    D --> G[Check live cmdline: config= for ngrok]
    F --> H[Assess: path, tunnel tool, service name]
    G --> H

Caveats

The post is a short field note built around observed cases (ngrok, komari-agent), not an exhaustive detection guide. NSSM is legitimate, so nssm.exe presence alone is not malicious — the signal is location, wrapped payload, and service name, all of which the analyst must judge in context.