Network Connection Initiated Via Notepad.EXE

calendar Oct 23, 2025 · attack.privilege-escalation attack.command-and-control attack.execution attack.defense-evasion attack.t1055  ·
Share on: linkedin copy

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

Sigma rule (View on GitHub)

 1title: Network Connection Initiated Via Notepad.EXE
 2id: e81528db-fc02-45e8-8e98-4e84aba1f10b
 3status: test
 4description: |
 5    Detects a network connection that is initiated by the "notepad.exe" process.
 6    This might be a sign of process injection from a beacon process or something similar.
 7    Notepad rarely initiates a network communication except when printing documents for example.    
 8references:
 9    - https://web.archive.org/web/20200219102749/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf
10    - https://www.cobaltstrike.com/blog/why-is-notepad-exe-connecting-to-the-internet
11author: EagleEye Team
12date: 2020-05-14
13modified: 2024-02-02
14tags:
15    - attack.privilege-escalation
16    - attack.command-and-control
17    - attack.execution
18    - attack.defense-evasion
19    - attack.t1055
20logsource:
21    category: network_connection
22    product: windows
23detection:
24    selection:
25        Image|endswith: '\notepad.exe'
26    filter_optional_printing:
27        DestinationPort: 9100
28    condition: selection and not 1 of filter_optional_*
29falsepositives:
30    - Printing documents via notepad might cause communication with the printer via port 9100 or similar.
31level: high

References

  • Wayback Machine

    COLLECTED BY This is a Collection of URLs (and Outlinked URLs) extracted from a random feed of 1% of all Tweets. TIMESTAMPS The Wayback Machine - https://web.archive.org/web/20200219102749/https://...


    Read More

  • Why is notepad.exe connecting to the internet? - Cobalt Strike

    To the observant network defender, notepad.exe connecting to the internet is a key indicator of compromise. In this blog post, I’d like to explain why attack frameworks inject code into notepad.exe and how you may avoid it in your attack process. Let’s say I email a Microsoft Word document that has a malicious macro to


    Read More

Related rules

to-top