🧰 NSSM

The items that name it 4

• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  article2026-10-09It is written here as NSSM (Non-Sucking Service Manager).

  Legitimate utility used to keep programs running and restart them after crash/reboot; modified copy named msedge.exe used by attackers for persistence

• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  writeup2026-10-08

  Legitimate utility to keep programs running/restart after crash or reboot; modified copy (msedge.exe) used by attackers to maintain persistence for the XMRig miner disguised as a Microsoft Edge Update service.

• Field Notes: NSSM - the Non-Sucking Service Manager
  writeup2026-07-27It is written here as NSSM (Non-Sucking Service Manager).

  Legitimate tool to run standard executables as Windows services; abused by attackers to wrap malicious/backdoor executables (e.g. ngrok) as a service for persistence and resilience

• Komari Red: The Monitoring Tool with a Built-in Reverse Shell
  writeup2026-04-30It is written here as NSSM (Non-Sucking Service Manager).

  Used to wrap komari-agent.exe as a Windows service ("Windows Update Service") running as SYSTEM for persistence