Windows Process Chain Involving Notepad++ Launched via RDPInit and Executed Through CMD
Alerts on rdpinit.exe -> notepad++.exe -> cmd.exe process chain consistent with interactive command execution.
- Product
- windows
- Category
- process_creation
- Author
- Alex Walston (@4ayymm) (SigmaHQ), DRL 1.1
- Published
- 2024-07-29
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags a suspicious Windows process chain where Notepad++ is launched by rdpinit.exe and then executes cmd.exe as a child process. Attackers can use RDP sessions to establish execution context and run command-line tooling, making these parent-child relationships a useful indicator of potential exploitation or post-access activity. The detection relies on process creation telemetry capturing executable paths and parent-child process relationships.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Chain Involving Notepad++ Launched via RDPInit and Executed Through CMD
id: 375ea84a-87c9-4758-abc2-87dea777ced2
status: test
description: This rule flags a suspicious Windows process chain where Notepad++ is launched by rdpinit.exe and then executes cmd.exe as a child process. Attackers can use RDP sessions to establish execution context and run command-line tooling, making these parent-child relationships a useful indicator of potential exploitation or post-access activity. The detection relies on process creation telemetry capturing executable paths and parent-child process relationships.
references:
- https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/FIN7/proc_creation_win_apt_fin7_exploitation_indicators.yml
author: Alex Walston (@4ayymm), Huntrule Team
date: 2024-07-29
tags:
- attack.execution
- attack.t1059.001
- attack.t1059.003
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_notepad_plus:
ParentImage|endswith: \notepad++.exe
Image|endswith: \cmd.exe
selection_rdpinit:
ParentImage|endswith: \rdpinit.exe
Image|endswith: \notepad++.exe
condition: 1 of selection_*
falsepositives:
- Notepad++ can legitimately spawn cmd (Open Containing Folder in CMD)
level: medium
license: DRL-1.1
related:
- id: 6676896b-2cce-422d-82af-5a1abe65e241
type: derived