First-party security reference · 8 minute read
Nizlo RMM security indicators for Windows
Use these files, paths, service, registry keys, protocols, and network destinations to recognize an expected Nizlo deployment and investigate unexpected activity with the right context.
Presence is not proof of compromise
Nizlo is legitimate RMM software used for authorized endpoint operations. Treat these values as identification and correlation evidence. Confirm tenant ownership, deployment authority, binary provenance, operator identity, and the action performed before deciding whether activity is expected or suspicious.
Windows artifacts
Executables
Nizlo.Agent.exeNizlo.Agent.Updater.exeNizlo.RemoteBridge.exe
The agent and updater normally reside under the agent installation directory. The remote bridge path can vary, so defenders should scope filename detections with signer, parent process, command line, tenant approval, and surrounding activity.
Windows paths
C:\Program Files\Nizlo\Agent\C:\ProgramData\Nizlo\Agent\
Program Files contains installed binaries. ProgramData holds service state and update working data. A filename observed elsewhere deserves investigation, but its location alone does not establish malicious use.
Service
Nizlo RMM Agent
The Windows agent installs as an automatic LocalSystem service. Its service registry entry is HKLM\SYSTEM\CurrentControlSet\Services\Nizlo RMM Agent.
Registry and URL protocols
HKLM\Software\Nizlo\AgentHKLM\Software\Classes\nizloHKLM\Software\Classes\nizlo-remotenizlo:nizlo-remote:
The protocol registrations support approved console-to-client launches. Review the registered command, binary path, user action, and authorization trail when investigating an unexpected launch.
Expected network behavior
Destination
app.nizlo.comTransport
Outbound TCP 443
Protocols
HTTPS and authenticated WSS
The Nizlo agent initiates outbound connections and does not expose an inbound shell or require an inbound firewall port. Investigate unexpected destinations, cleartext transport, or an unknown process using the same hostname.
Investigation checklist
Confirm the endpoint belongs to a tenant that authorized Nizlo deployment.
Compare the executable path, signature, version, and hash with the approved installer or release evidence.
Review service creation, protocol-handler registration, parent process, command line, and nearby process activity.
Correlate the event with the technician identity, Nizlo audit history, ticket, change, or support window.
Verify outbound traffic is limited to the expected app.nizlo.com service over TCP 443.
Escalate unexpected deployment, unknown tenant ownership, unsigned or altered binaries, unusual child processes, or activity outside approved scope.
Product and deployment references
Machine-readable indicator dataset
Nizlo also publishes these documented values as a versioned, reusable dataset for authorized defensive workflows. The public repository includes JSON, CSV, a JSON Schema, citation metadata, release history, and automated parity checks.
Relationship disclosure: Nizlo maintains both this reference and the external dataset. That first-party relationship is explicit so defenders can assess provenance and scope.
Community indicator references
These community-maintained datasets help defenders recognize RMM software. Their inclusion is identification context, not a claim that Nizlo or another listed tool is malicious.
Validate on authorized endpoints
Run a measured 14-day Nizlo trial.
Qualified MSP and IT operators can evaluate Nizlo without a credit card on authorized lab or noncritical systems. Founding Tester discounts are awarded by successful paid upgrade order: the first five receive 75% off for life, the next five 50%, and the next ten 25%. Applying or starting a trial does not reserve a position.
Start the 14-day trialNizlo indicator questions
Does finding Nizlo on an endpoint mean it is compromised?
No. Nizlo is legitimate remote monitoring and management software. Confirm whether the endpoint, tenant, installer, operator, and observed action are authorized. An artifact can support an investigation, but presence alone is not evidence of malicious use.
Which domain should the Nizlo agent contact?
The production agent uses app.nizlo.com over outbound TCP 443 for HTTPS API traffic and an authenticated secure WebSocket. The agent does not require an inbound firewall port.
What should a defender verify during an investigation?
Verify tenant ownership, endpoint authorization, installer provenance, executable signature or hash, service configuration, parent and child processes, command line, outbound destination, technician identity, audit records, and whether the action matches an approved support or maintenance window.