nssm.exe
Summary
Non-Sucking Service Manager. Open-source tool for running arbitrary executables as Windows services, with automatic restart on failure. Used legitimately for service management but also for persistence by running malware as a service.
nssm.exe is the 2930th most commonly executed Windows program in EchoTrail's dataset, observed 104 times across enterprise environments. It typically runs from C:\Program Files (x86)\Client\ClientLauncher and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Client\ClientLauncher59.62%
- C:\Program Files\NordVPN11.54%
- C:\Program Files\VMware\VMware View\Server\appblastgateway9.62%
- D:\Program Files (x86)\CatTools34.81%
- C:\Program Files\GrafanaLabs\svc-9.4.7.03.85%
- C:\Program Files (x86)\CatTools33.85%
- D:\Program Files\nssm3.85%
- C:\Program Files\GrafanaLabs\svc-9.5.2.02.88%
Top Hashes (SHA256)
- 0720daf9c5f8ca9dd7c9cf51077d274a28a4b81120e1b771177cb6c46962066859.62%
- 1eca415f94d4975c45a0426dab3a1777909277e52ee12e10535e2b0b18a54ee011.54%
- f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c9710.58%
- 397700f5a731e42714bcc4078e07d026491e08fa0a8b9a033ff8761d566f7d509.62%
- c49532aef57d77ebd7a7dd91d6c411908cf950f9514bfbbff104f5a62d7939cf8.65%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe89.42%
Top Children
- node.exe50%
- conhost.exe22.13%
- cmd.exe8.2%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does nssm.exe normally do?
Runs from wherever installed (not a Windows built-in). Used to wrap executables that don't have native Windows service support (Node.js apps, Python scripts, etc.) as services. Provides monitoring, restart-on-failure, stdout/stderr logging.
When is nssm.exe suspicious?
nssm.exe installing a service for an executable in a temp directory, user profile, or unusual location. Installing services for known attack tools. Rapid service creation. nssm.exe present on systems without known administrative use.
How do attackers abuse nssm.exe?
PERSISTENCE VIA SERVICE: Attackers use nssm to install malware as a Windows service: "nssm install MalwareService C:\Users\Public\payload.exe" "nssm start MalwareService" This provides: automatic startup at boot, automatic restart if the process is killed, running as SYSTEM by default, and a legitimate-looking service entry. nssm itself is not malicious, so it may not be flagged by AV.
Detection guidance
MEDIUM-CONFIDENCE DETECTIONS: - nssm.exe creating services for executables in non-standard locations - nssm.exe present on systems without documented administrative use - Service creation events where the service binary path contains nssm.exe DATA SOURCES: Process creation (Sysmon 1), service installation (System 7045)
False positive notes
Widely used legitimately by developers and IT admins to run applications as services (Redis, Elasticsearch, custom apps). Common in DevOps environments. The key differentiator is what executable is being wrapped as a service.
Related Processes
Ask Rocky about nssm.exe
Rocky answers questions about nssm.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.