Notepad++ Installer Making External Network Connection
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects a Notepad++ installer initiating outbound network connections, which is not expected during normal update execution and may indicate supply-chain compromise.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "Network Connection" AND (PROCESSNAME contains "\npp." AND PROCESSNAME contains "installer" AND PROCESSNAME endswith ".exe" AND DEST_IP notcontains "10.,192.168.,172.16.,172.17.,172.18.,172.19.,172.20.,172.21.,172.22.,172.23.,172.24.,172.25.,172.26.,172.27.,172.28.,172.29.,172.30.,172.31.,127.,169.254.,::1,0:0:0:0:0:0:0:1,fe80:,fc,fd")
select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
