Network Connection Initiated Via Notepad.EXE

calendar Feb 12, 2024 · attack.command_and_control attack.execution attack.defense_evasion attack.t1055  ·
Share on: linkedin copy

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

Sigma rule (View on GitHub)

 1title: Network Connection Initiated Via Notepad.EXE
 2id: e81528db-fc02-45e8-8e98-4e84aba1f10b
 3status: test
 4description: |
 5    Detects a network connection that is initiated by the "notepad.exe" process.
 6    This might be a sign of process injection from a beacon process or something similar.
 7    Notepad rarely initiates a network communication except when printing documents for example.    
 8references:
 9    - https://web.archive.org/web/20200219102749/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf
10    - https://www.cobaltstrike.com/blog/why-is-notepad-exe-connecting-to-the-internet
11author: EagleEye Team
12date: 2020/05/14
13modified: 2024/02/02
14tags:
15    - attack.command_and_control
16    - attack.execution
17    - attack.defense_evasion
18    - attack.t1055
19logsource:
20    category: network_connection
21    product: windows
22detection:
23    selection:
24        Image|endswith: '\notepad.exe'
25    filter_optional_printing:
26        DestinationPort: 9100
27    condition: selection and not 1 of filter_optional_*
28falsepositives:
29    - Printing documents via notepad might cause communication with the printer via port 9100 or similar.
30level: high

References

  • Wayback Machine

    COLLECTED BY This is a Collection of URLs (and Outlinked URLs) extracted from a random feed of 1% of all Tweets. TIMESTAMPS The Wayback Machine - https://web.archive.org/web/20200219102749/https://...


    Read More

  • Why is notepad.exe connecting to the internet? - Cobalt Strike

    To the observant network defender, notepad.exe connecting to the internet is a key indicator of compromise. In this blog post, I’d like to explain why attack frameworks inject code into notepad.exe and how you may avoid it in your attack process. Let’s say I email a Microsoft Word document that has a malicious macro to


    Read More

Related rules

to-top