
title: Notepad Making Network Connection
author: EagleEye Team
date: 2020/05/14
description: Detects suspicious network connection by Notepad
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    Image: '*\notepad.exe'
  SELECTION_3:
    DestinationPort: '9100'
  condition: (SELECTION_1 and SELECTION_2 and  not (SELECTION_3))
falsepositives:
- None observed so far
id: e81528db-fc02-45e8-8e98-4e84aba1f10b
level: high
logsource:
  category: network_connection
  product: windows
modified: 2020/08/24
references:
- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf
- https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/
status: experimental
tags:
- attack.command_and_control
- attack.execution
- attack.defense_evasion
- attack.t1055
ruletype: SIGMA
