Nssm-2.24 Privilege Escalation [new] Jun 2026

C:\ProgramData\... or C:\Program Files\... with weak permissions Full system takeover (Vertical Privilege Escalation) Detection EDR alerts for nssm.exe in unusual paths like \Windows\tmp\ Prevention & Mitigation

Since NSSM is designed to restart the service if it fails, the attacker can either wait for a system reboot or manually crash the service if they have the rights. Once NSSM restarts the "service," it executes the attacker's payload with SYSTEM privileges. Remediation and Best Practices