Nssm-2.24 Privilege Escalation

Implement file integrity monitoring to detect unauthorized modifications to nssm.exe and other critical binaries. Set up alerts for any changes to service executable files, particularly those running under high-privilege accounts.

This vulnerability, discovered in mid-2025, allows a low-privileged local attacker to exploit set on the nssm.exe file. This misconfiguration enables an authenticated user to replace the legitimate nssm.exe binary with a malicious one. Once replaced, the next time NSSM is invoked—whether by a service restart, a scheduled task, or an unsuspecting administrator—the malicious code executes with the elevated privileges of the calling process. Typically, this means the attacker can gain SYSTEM or Administrator-level access , allowing them to install malware, create new administrative users, or exfiltrate sensitive data. nssm-2.24 privilege escalation

Windows Privilege Escalation — Part 1 (Unquoted Service Path) Windows Privilege Escalation — Part 1 (Unquoted Service

Attackers can install additional backdoors, rootkits, and persistence mechanisms that remain undetected for extended periods, turning the compromised system into a long-term foothold. a scheduled task

When NSSM 2.24 is present, it is usually targeted via three common Windows service misconfigurations: Head Mare and Twelve: Joint attacks on Russian entities