First-party dataset · Version 1.0.0 · No signup

Nizlo RMM security indicators for Windows

Name: Nizlo RMM security indicators for Windows
Creator: Nizlo
Published: 2026-11-02
License: https://opensource.org/license/mit

Download machine-readable artifacts for identifying an expected Nizlo deployment and investigating unexpected activity with the right authorization and process context.

Download JSON Download CSV View JSON Schema LLM-readable summary Read the full reference

Presence alone is not evidence of compromise. Nizlo is legitimate RMM software. Confirm tenant ownership, endpoint authorization, installer provenance, operator identity, audit history, and the action performed.

Executables

Nizlo.Agent.exeNizlo.Agent.Updater.exeNizlo.RemoteBridge.exe

Windows paths

C:\Program Files\Nizlo\Agent\C:\ProgramData\Nizlo\Agent\

Service

Nizlo RMM Agent

Automatic Windows service running as LocalSystem.

Registry and protocols

HKLM\Software\Nizlo\AgentHKLM\Software\Classes\nizloHKLM\Software\Classes\nizlo-remotenizlo:nizlo-remote:

Expected network behavior

app.nizlo.com:443

Outbound TCP 443 using HTTPS or authenticated WSS. No inbound firewall port is required.

Investigation scope

Correlate paths and names with signer or hash, parent and child processes, command line, technician identity, tickets or change windows, and the authorized tenant.