Windows: Notepad Password File Discovery via Process Creation
Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.
- Product
- windows
- Category
- process_creation
- Author
- The DFIR Report (SigmaHQ), DRL 1.1
- Published
- 2025-02-21
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of notepad.exe launched from explorer.exe where the command line targets filenames beginning with "password" and specific extensions such as .txt, .csv, .doc, and .xls. Opening these files in plaintext strongly suggests credential discovery or handling of sensitive data and may indicate unauthorized access attempts. Telemetry relies on Windows process creation events including parent process, image path, and the full command line.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- intel.thedfirreport.comhttps://intel.thedfirreport.com/eventReports/view/57
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Notepad Password File Discovery via Process Creation"
id: 697a354f-09ed-449a-9fda-5dc9700c8b01
status: experimental
description: This rule identifies execution of notepad.exe launched from explorer.exe where the command line targets filenames beginning with "password" and specific extensions such as .txt, .csv, .doc, and .xls. Opening these files in plaintext strongly suggests credential discovery or handling of sensitive data and may indicate unauthorized access attempts. Telemetry relies on Windows process creation events including parent process, image path, and the full command line.
references:
- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- https://intel.thedfirreport.com/eventReports/view/57
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml
author: The DFIR Report, Huntrule Team
tags:
- attack.discovery
- attack.t1083
date: 2025-02-21
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: \explorer.exe
Image|endswith: \notepad.exe
CommandLine|endswith:
- password*.txt
- password*.csv
- password*.doc
- password*.xls
condition: selection
falsepositives:
- Legitimate use of opening files from remote hosts by administrators or users. However, storing passwords in text readable format could potentially be a violation of the organization's policy. Any match should be investigated further.
level: low
license: DRL-1.1
related:
- id: 3b4e950b-a3ea-44d3-877e-432071990709
type: derived