Windows Process Chain: rdpinit.exe spawning Notepad++ that executes cmd.exe

Alerts on rdpinit.exe -> notepad++.exe -> cmd.exe process chain consistent with interactive command execution.

FreeUnreviewedSigmamediumv1

windows-process-chain-rdpinit-exe-spawning-notepad-that-executes-cmd-exe-6676896b

title: "Windows Process Chain: rdpinit.exe spawning Notepad++ that executes cmd.exe"
id: 375ea84a-87c9-4758-abc2-87dea777ced2
status: test
description: This rule flags a Windows process creation pattern where rdpinit.exe spawns notepad++.exe, and notepad++.exe then launches cmd.exe. Such process chaining can indicate interactive access followed by command execution, which attackers often use to establish initial footholds and run follow-on actions. Telemetry relied on is process creation events capturing parent/child process image paths for rdpinit.exe, notepad++.exe, and cmd.exe.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/FIN7/proc_creation_win_apt_fin7_exploitation_indicators.yml
author: Alex Walston (@4ayymm), Huntrule Team
date: 2024-07-29
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_notepad_plus:
    ParentImage|endswith: \notepad++.exe
    Image|endswith: \cmd.exe
  selection_rdpinit:
    ParentImage|endswith: \rdpinit.exe
    Image|endswith: \notepad++.exe
  condition: 1 of selection_*
falsepositives:
  - Notepad++ can legitimately spawn cmd (Open Containing Folder in CMD)
level: medium
license: DRL-1.1
related:
  - id: 6676896b-2cce-422d-82af-5a1abe65e241
    type: derived

What it detects

This rule flags a Windows process creation pattern where rdpinit.exe spawns notepad++.exe, and notepad++.exe then launches cmd.exe. Such process chaining can indicate interactive access followed by command execution, which attackers often use to establish initial footholds and run follow-on actions. Telemetry relied on is process creation events capturing parent/child process image paths for rdpinit.exe, notepad++.exe, and cmd.exe.

Known false positives

Notepad++ can legitimately spawn cmd (Open Containing Folder in CMD)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.