Windows: New Notepad++ plugins DLL written outside gup.exe
Alerts on creation of Notepad++ plugin DLLs by a process other than gup.exe, suggesting possible persistence via custom plugins.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-10
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where a new .dll is written under a Notepad++ plugins directory. It excludes writes performed by Notepad++ updater gup.exe and further filters activity from common installer-related paths. Creating or modifying plugin DLLs outside the updater can indicate persistence or unauthorized extension loading, and the rule relies on Windows file event telemetry that includes TargetFilename and the writing Image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-new-notepad-plugin-dll-creation-outside-gup-exe-54127bd4
title: "Windows: New Notepad++ plugins DLL written outside gup.exe"
id: 86fab1e4-e9da-4485-84cd-36450eef05bb
status: test
description: This rule flags file creation events where a new .dll is written under a Notepad++ plugins directory. It excludes writes performed by Notepad++ updater gup.exe and further filters activity from common installer-related paths. Creating or modifying plugin DLLs outside the updater can indicate persistence or unauthorized extension loading, and the rule relies on Windows file event telemetry that includes TargetFilename and the writing Image path.
references:
- https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2025-09-01
tags:
- attack.persistence
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: \Notepad++\plugins\
TargetFilename|endswith: .dll
filter_gup:
Image|endswith: \Notepad++\updater\gup.exe
filter_install:
Image|startswith: C:\Users\
Image|contains: \AppData\Local\Temp\
Image|endswith:
- \target.exe
- Installer.x64.exe
filter_main_installer:
Image|contains: \npp.
Image|endswith: .exe
TargetFilename:
- C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll
- C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll
- C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll
- C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
condition: selection and not 1 of filter_*
falsepositives:
- Possible FPs during first installation of Notepad++
- Legitimate use of custom plugins by users in order to enhance notepad++ functionalities
level: medium
license: DRL-1.1
related:
- id: 54127bd4-f541-4ac3-afdb-ea073f63f692
type: derived