Windows: Suspicious regsvr32 invocation by Notepad++ installer referencing NppShell.dll
Alerts when regsvr32 is run silently to register NppShell.dll but the regsvr32 image isn’t from standard Windows system locations.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-06-26
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where regsvr32.exe is launched with quiet options and a command line referencing \contextMenu\NppShell.dll. It focuses on cases where the regsvr32 process path ends with \regsvr32.exe and is not one of the standard Windows System32/SysWOW64 binaries, which can indicate a hijacked or side-loaded regsvr32. The detection relies on Windows process creation telemetry, including process image path and command-line content.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious regsvr32 invocation by Notepad++ installer referencing NppShell.dll"
id: b0030c13-21b3-45b3-a5b5-4d566df1451f
status: experimental
description: This rule flags process creation events where regsvr32.exe is launched with quiet options and a command line referencing \contextMenu\NppShell.dll. It focuses on cases where the regsvr32 process path ends with \regsvr32.exe and is not one of the standard Windows System32/SysWOW64 binaries, which can indicate a hijacked or side-loaded regsvr32. The detection relies on Windows process creation telemetry, including process image path and command-line content.
references:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49144
- https://x.com/NullSecurityX/status/1937444064867029179
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-49144/proc_creation_win_exploit_cve_2025_49144.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-26
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.008
- cve.2025-49144
- detection.emerging-threats
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: \regsvr32.exe
CommandLine|startswith: regsvr32 /s
CommandLine|contains: \contextMenu\NppShell.dll
filter_main_legit_regsvr32:
Image:
- C:\Windows\System32\regsvr32.exe
- C:\Windows\SysWOW64\regsvr32.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 933f0bb5-0681-4fe7-8a17-4e6cccbaac44
type: derived