Windows: New Notepad++ plugin DLL creation outside gup.exe

Alerts on creation of Notepad++ plugin DLLs by a process other than gup.exe, suggesting possible persistence via custom plugins.

FreeUnreviewedSigmamediumv1

windows-new-notepad-plugin-dll-creation-outside-gup-exe-54127bd4

title: "Windows: New Notepad++ plugin DLL creation outside gup.exe"
id: 86fab1e4-e9da-4485-84cd-36450eef05bb
status: test
description: This rule flags file creation events for DLLs located under the Notepad++ plugins directory when the creating process is not Notepad++ updater gup.exe. Loading attacker-controlled plugin DLLs can provide persistence by extending the application’s functionality. The detection relies on Windows file event telemetry containing the target file path and the writing process image path to exclude the expected updater component and common installer contexts.
references:
  - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2025-09-01
tags:
  - attack.persistence
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \Notepad++\plugins\
    TargetFilename|endswith: .dll
  filter_gup:
    Image|endswith: \Notepad++\updater\gup.exe
  filter_install:
    Image|startswith: C:\Users\
    Image|contains: \AppData\Local\Temp\
    Image|endswith:
      - \target.exe
      - Installer.x64.exe
  filter_main_installer:
    Image|contains: \npp.
    Image|endswith: .exe
    TargetFilename:
      - C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll
      - C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll
      - C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll
      - C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
  condition: selection and not 1 of filter_*
falsepositives:
  - Possible FPs during first installation of Notepad++
  - Legitimate use of custom plugins by users in order to enhance notepad++ functionalities
level: medium
license: DRL-1.1
related:
  - id: 54127bd4-f541-4ac3-afdb-ea073f63f692
    type: derived

What it detects

This rule flags file creation events for DLLs located under the Notepad++ plugins directory when the creating process is not Notepad++ updater gup.exe. Loading attacker-controlled plugin DLLs can provide persistence by extending the application’s functionality. The detection relies on Windows file event telemetry containing the target file path and the writing process image path to exclude the expected updater component and common installer contexts.

Known false positives

Possible FPs during first installation of Notepad++
Legitimate use of custom plugins by users in order to enhance notepad++ functionalities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.