Sigma rule: Network Connection Initiated Via Notepad.EXE

Rule

Title

Network Connection Initiated Via Notepad.EXE

Status

test

Level

high

Author

EagleEye Team

Date

2020-05-14

Modified

2024-02-02

File

rules/windows/network_connection/net_connection_win_notepad.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.

Log source

product

windows

category

network_connection

Detection

selection:
    Image|endswith: '\notepad.exe'
filter_optional_printing:
    DestinationPort: 9100
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Printing documents via notepad might cause communication with the printer via port 9100 or similar.

Tags

• attack.privilege-escalation
• attack.command-and-control
• attack.execution
• attack.stealth
• attack.t1055

MITRE ATT&CK ids this rule names

• T1055

References

• https://web.archive.org/web/20200219102749/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf
• https://www.cobaltstrike.com/blog/why-is-notepad-exe-connecting-to-the-internet

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/network_connection/net_connection_win_notepad.yml