Windows: New Notepad++ plugins DLL written outside gup.exe

title: "Windows: New Notepad++ plugins DLL written outside gup.exe"
id: 86fab1e4-e9da-4485-84cd-36450eef05bb
status: test
description: This rule flags file creation events where a new .dll is written under a Notepad++ plugins directory. It excludes writes performed by Notepad++ updater gup.exe and further filters activity from common installer-related paths. Creating or modifying plugin DLLs outside the updater can indicate persistence or unauthorized extension loading, and the rule relies on Windows file event telemetry that includes TargetFilename and the writing Image path.
references:
  - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2025-09-01
tags:
  - attack.persistence
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \Notepad++\plugins\
    TargetFilename|endswith: .dll
  filter_gup:
    Image|endswith: \Notepad++\updater\gup.exe
  filter_install:
    Image|startswith: C:\Users\
    Image|contains: \AppData\Local\Temp\
    Image|endswith:
      - \target.exe
      - Installer.x64.exe
  filter_main_installer:
    Image|contains: \npp.
    Image|endswith: .exe
    TargetFilename:
      - C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll
      - C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll
      - C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll
      - C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
  condition: selection and not 1 of filter_*
falsepositives:
  - Possible FPs during first installation of Notepad++
  - Legitimate use of custom plugins by users in order to enhance notepad++ functionalities
level: medium
license: DRL-1.1
related:
  - id: 54127bd4-f541-4ac3-afdb-ea073f63f692
    type: derived