Windows: Suspicious regsvr32 invocation by Notepad++ installer referencing NppShell.dll

title: "Windows: Suspicious regsvr32 invocation by Notepad++ installer referencing NppShell.dll"
id: b0030c13-21b3-45b3-a5b5-4d566df1451f
status: experimental
description: This rule flags process creation events where regsvr32.exe is launched with quiet options and a command line referencing \contextMenu\NppShell.dll. It focuses on cases where the regsvr32 process path ends with \regsvr32.exe and is not one of the standard Windows System32/SysWOW64 binaries, which can indicate a hijacked or side-loaded regsvr32. The detection relies on Windows process creation telemetry, including process image path and command-line content.
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49144
  - https://x.com/NullSecurityX/status/1937444064867029179
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-49144/proc_creation_win_exploit_cve_2025_49144.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-26
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.008
  - cve.2025-49144
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: \regsvr32.exe
    CommandLine|startswith: regsvr32 /s
    CommandLine|contains: \contextMenu\NppShell.dll
  filter_main_legit_regsvr32:
    Image:
      - C:\Windows\System32\regsvr32.exe
      - C:\Windows\SysWOW64\regsvr32.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 933f0bb5-0681-4fe7-8a17-4e6cccbaac44
    type: derived