Windows: Notepad Password File Discovery via Process Creation

title: "Windows: Notepad Password File Discovery via Process Creation"
id: 697a354f-09ed-449a-9fda-5dc9700c8b01
status: experimental
description: This rule identifies execution of notepad.exe launched from explorer.exe where the command line targets filenames beginning with "password" and specific extensions such as .txt, .csv, .doc, and .xls. Opening these files in plaintext strongly suggests credential discovery or handling of sensitive data and may indicate unauthorized access attempts. Telemetry relies on Windows process creation events including parent process, image path, and the full command line.
references:
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
  - https://intel.thedfirreport.com/eventReports/view/57
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml
author: The DFIR Report, Huntrule Team
tags:
  - attack.discovery
  - attack.t1083
date: 2025-02-21
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \explorer.exe
    Image|endswith: \notepad.exe
    CommandLine|endswith:
      - password*.txt
      - password*.csv
      - password*.doc
      - password*.xls
  condition: selection
falsepositives:
  - Legitimate use of opening files from remote hosts by administrators or users. However, storing passwords in text readable format could potentially be a violation of the organization's policy. Any match should be investigated further.
level: low
license: DRL-1.1
related:
  - id: 3b4e950b-a3ea-44d3-877e-432071990709
    type: derived