nssm.exe
Sources: 300M+ executions observed in the wild.
Summary
Non-Sucking Service Manager. Open-source tool for running arbitrary executables as Windows services, with automatic restart on failure. Used legitimately for service management but also for persistence by running malware as a service.
nssm.exe is the 2930th most commonly executed Windows program in EchoTrail's dataset, observed 104 times across enterprise environments. It typically runs from C:\Program Files (x86)\Client\ClientLauncher and it is most often launched by services.exe.
Get this in your tools
The same record for nssm.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/nssm.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\Client\ClientLauncher59.62%
- C:\Program Files\NordVPN11.54%
- C:\Program Files\VMware\VMware View\Server\appblastgateway9.62%
- D:\Program Files (x86)\CatTools34.81%
- C:\Program Files\GrafanaLabs\svc-9.4.7.03.85%
- C:\Program Files (x86)\CatTools33.85%
- D:\Program Files\nssm3.85%
- C:\Program Files\GrafanaLabs\svc-9.5.2.02.88%
Top Hashes (SHA256)
- 0720daf9c5f8ca9dd7c9cf51077d274a28a4b81120e1b771177cb6c46962066859.62%
- 1eca415f94d4975c45a0426dab3a1777909277e52ee12e10535e2b0b18a54ee011.54%
- f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c9710.58%
- 397700f5a731e42714bcc4078e07d026491e08fa0a8b9a033ff8761d566f7d509.62%
- c49532aef57d77ebd7a7dd91d6c411908cf950f9514bfbbff104f5a62d7939cf8.65%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe89.42%
Top Children
- node.exe50%
- conhost.exe22.13%
- cmd.exe8.2%
Security Analysis
What does nssm.exe normally do?
Runs from wherever installed (not a Windows built-in). Used to wrap executables that don't have native Windows service support (Node.js apps, Python scripts, etc.) as services. Provides monitoring, restart-on-failure, stdout/stderr logging.
When is nssm.exe suspicious?
nssm.exe installing a service for an executable in a temp directory, user profile, or unusual location. Installing services for known attack tools. Rapid service creation. nssm.exe present on systems without known administrative use.
How do attackers abuse nssm.exe?
PERSISTENCE VIA SERVICE: Attackers use nssm to install malware as a Windows service: "nssm install MalwareService C:\Users\Public\payload.exe" "nssm start MalwareService" This provides: automatic startup at boot, automatic restart if the process is killed, running as SYSTEM by default, and a legitimate-looking service entry. nssm itself is not malicious, so it may not be flagged by AV.
Detection guidance
MEDIUM-CONFIDENCE DETECTIONS: - nssm.exe creating services for executables in non-standard locations - nssm.exe present on systems without documented administrative use - Service creation events where the service binary path contains nssm.exe DATA SOURCES: Process creation (Sysmon 1), service installation (System 7045)
False positive notes
Widely used legitimately by developers and IT admins to run applications as services (Redis, Elasticsearch, custom apps). Common in DevOps environments. The key differentiator is what executable is being wrapped as a service.
Related Processes
Ask Rocky about nssm.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for nssm.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.