Possible Persistence Through Notepad++ Plugins (via file_event)

title: Possible Persistence Through Notepad++ Plugins (via file_event)
id: 1c918469-d86c-5ad2-a99e-2337bac1ce69
status: stable
description: This rule detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could suggests possible persistence
references:
    - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/
author: Huntrule Team
date: 2026-01-26
tags:
    - attack.persistence
    - attack.t1574
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '\Notepad++\plugins\'
        TargetFilename|endswith: '.dll'
    filter_gup:
        Image|endswith: '\Notepad++\updater\gup.exe'
    filter_install:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Temp\'
        Image|endswith:
            - '\target.exe'
            - 'Installer.x64.exe'
    filter_main_installer:
        Image|contains: '\npp.'
        Image|endswith: '.exe'
        TargetFilename:
            - 'C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll'
            - 'C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll'
            - 'C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll'
            - 'C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll'
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: medium