Sigma rule: Notepad Password Files Discovery

Rule

Title

Notepad Password Files Discovery

Status

experimental

Level

low

Author

The DFIR Report

Date

2025-02-21

File

rules/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith: '\notepad.exe'
    CommandLine|endswith:
    # Note: Commandline to contain a file with the string password and a specific extension
        - 'password*.txt'
        - 'password*.csv'
        - 'password*.doc'
        - 'password*.xls'
condition: selection

False positives (as the rule lists them)

• Legitimate use of opening files from remote hosts by administrators or users. However, storing passwords in text readable format could potentially be a violation of the organization's policy. Any match should be investigated further.

Tags

• attack.discovery
• attack.t1083

MITRE ATT&CK ids this rule names

• T1083

References

• https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
• https://intel.thedfirreport.com/eventReports/view/57

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml