Network Connection Initiated Via Notepad.EXE

About the rule

Rule Type

Standard

Rule Description

Notepad.EXE is a Windows utility triggered during basic text editing. Network Connection initiated Via Notepad.EXE is a process that essentially resulted in process hollowing, code injection from the beacon process or masquerading by a malicious vector, as a approach to bypass the detection mechanism.

Severity

Trouble

Rule journey

Attack chain scenario

Initial access (malware dropper) → Execution (power-shell scripting) → Defense Evasion → Command and control → Impact

Impact

1. Malware injects code into notepad.exe, using DLL injection techniques such as Beacon process to evade detection.
2. Notepad process initiates outbound HTTP/HTTPS communication to the attacker-controlled C2 server.
3. Data exfiltration is achieved.

Rule Requirement

Prerequisites

• Download and install Sysmon from Microsoft Sysinternals. Then, open a Command prompt with administrator privileges and create a Sysmon configuration which monitors the network connection using -

sysmon.exe -i [configfile.xml].

• Add network connection events to monitor in your configuration file using -

<Sysmon>
<EventFiltering>
<NetworkConnect onmatch="exclude"/>
<!-- This captures all network connection events -->
</EventFiltering>
</Sysmon>

• Create a new registry key "Microsoft-Windows-Sysmon/Network" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".
• Allocate the registry value of Max Size to 200MB to ensure adequate storage for network logs, as they tend to be high volume.

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

Defense Evasion: Process Injection (T1055), Privilege Escalation: Process Injection (T1055)

Security Standards

Enabling this rule will help you meet the security standard's requirement listed below:

DE.CM-01: Networks and network services are monitored to find potentially adverse events.

Security administrators have to continuously monitor all the network and its services in real-time using SIEM tools and identify the unusual behavior during the connection initiated to LocalToNet tunneling services. Enforce the policies on the web traffic to ensure the network security.

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Security administrators ensure to draft and implement strict privilege permission for critical operations of certification and its processes. Leverage IAM and SIEM solutions to ensure access permission and authorizations and regular auditing practices.

Author

EagleEye Team

Future actions

Known False Positives

Malware analysis tools or EDR testing frameworks may simulate network connection via Notepad.EXEs in sandbox environments, leading to harmless network activity being flagged.

Next Steps

When this rule is triggered, the following measures can be implemented:

1. Identification: Identify the event and check if the flagged incident is new or the existing one.
2. Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
3. Response: Respond promptly by initiating an automated workflow to interrupt the network connections and kill or terminate the malicious process.
4. Reconfiguration: Update the network policies and port configurations and continuously monitor traffic trends in the network.

Mitigation