Windows Process Creation: Suspicious regsvr32 Use by Notepad++ Installer for CVE-2025-49144

title: "Windows Process Creation: Suspicious regsvr32 Use by Notepad++ Installer for CVE-2025-49144"
id: b0030c13-21b3-45b3-a5b5-4d566df1451f
status: experimental
description: This rule flags Windows process creation events where regsvr32.exe is launched with silent execution and the command line references NppShell.dll under a Notepad++ context. It is designed to identify cases where a Notepad++ installer may invoke regsvr32.exe without a fully qualified path, allowing a malicious regsvr32.exe located alongside the installer to run instead. The logic relies on process image path and command-line content, while excluding executions from standard System32/SysWOW64 regsvr32 locations.
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49144
  - https://x.com/NullSecurityX/status/1937444064867029179
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-49144/proc_creation_win_exploit_cve_2025_49144.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-26
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.008
  - cve.2025-49144
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: \regsvr32.exe
    CommandLine|startswith: regsvr32 /s
    CommandLine|contains: \contextMenu\NppShell.dll
  filter_main_legit_regsvr32:
    Image:
      - C:\Windows\System32\regsvr32.exe
      - C:\Windows\SysWOW64\regsvr32.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 933f0bb5-0681-4fe7-8a17-4e6cccbaac44
    type: derived