Sigma rule: Potential Persistence Via Notepad++ Plugins

Rule

Title

Potential Persistence Via Notepad++ Plugins

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-06-10

Modified

2025-09-01

File

rules/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|contains: '\Notepad++\plugins\'
    TargetFilename|endswith: '.dll'
filter_gup:
    Image|endswith: '\Notepad++\updater\gup.exe'
filter_install:
    # This filter is for Sigma dataset you could remove it or change when using the rule in your own env
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Temp\'
    Image|endswith:
        - '\target.exe'
        - 'Installer.x64.exe'
filter_main_installer:
    Image|contains: '\npp.'
    Image|endswith: '.exe'
    TargetFilename:
        - 'C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll'
        - 'C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll'
        - 'C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll'
        - 'C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll'
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• Possible FPs during first installation of Notepad++
• Legitimate use of custom plugins by users in order to enhance notepad++ functionalities

Tags

• attack.persistence

References

• https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml