title: Notepad Making Network Connection
author: EagleEye Team
date: 2020/05/14
description: Detects suspicious network connection by Notepad
detection:
    SELECTION_1:
        EventID: 3
    SELECTION_2:
        Image: '*\notepad.exe'
    SELECTION_3:
        DestinationPort: '9100'
    condition: (SELECTION_1 and SELECTION_2 and  not (SELECTION_3))
falsepositives:
- None observed so far
id: e81528db-fc02-45e8-8e98-4e84aba1f10b
level: high
logsource:
    category: network_connection
    product: windows
modified: 2020/08/24
references:
- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf
- https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/
status: experimental
tags:
- attack.command_and_control
- attack.execution
- attack.defense_evasion
- attack.t1055
yml_filename: sysmon_notepad_network_connection.yml
yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/network_connection