Windows network connections initiated by notepad.exe

Alerts when notepad.exe initiates an outbound network connection, excluding typical printing traffic on port 9100.

FreeUnreviewedSigmahighv1

windows-network-connections-initiated-by-notepad-exe-e81528db

title: Windows network connections initiated by notepad.exe
id: ef224332-8b56-4613-886e-8b61c54559dd
status: test
description: This rule identifies outbound network connections where the initiating process image ends with notepad.exe. Unexpected network activity from a typically local text editor can indicate malicious process abuse, such as injection or command-and-control behavior. The detection relies on Windows network_connection telemetry that records the initiating process image and the destination port, excluding common printing-related traffic on port 9100.
references:
  - https://web.archive.org/web/20200219102749/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf
  - https://www.cobaltstrike.com/blog/why-is-notepad-exe-connecting-to-the-internet
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_notepad.yml
author: EagleEye Team, Huntrule Team
date: 2020-05-14
modified: 2024-02-02
tags:
  - attack.privilege-escalation
  - attack.command-and-control
  - attack.execution
  - attack.stealth
  - attack.t1055
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \notepad.exe
  filter_optional_printing:
    DestinationPort: 9100
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Printing documents via notepad might cause communication with the printer via port 9100 or similar.
level: high
license: DRL-1.1
related:
  - id: e81528db-fc02-45e8-8e98-4e84aba1f10b
    type: derived

What it detects

This rule identifies outbound network connections where the initiating process image ends with notepad.exe. Unexpected network activity from a typically local text editor can indicate malicious process abuse, such as injection or command-and-control behavior. The detection relies on Windows network_connection telemetry that records the initiating process image and the destination port, excluding common printing-related traffic on port 9100.

Known false positives

Printing documents via notepad might cause communication with the printer via port 9100 or similar.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.