sigmamediumHunting

Potential Persistence Via Notepad++ Plugins

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Detection Query

selection:
  TargetFilename|contains: \Notepad++\plugins\
  TargetFilename|endswith: .dll
filter_gup:
  Image|endswith: \Notepad++\updater\gup.exe
filter_install:
  Image|startswith: C:\Users\
  Image|contains: \AppData\Local\Temp\
  Image|endswith:
    - \target.exe
    - Installer.x64.exe
filter_main_installer:
  Image|contains: \npp.
  Image|endswith: .exe
  TargetFilename:
    - C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll
    - C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll
    - C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll
    - C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
condition: selection and not 1 of filter_*

Author

Nasreddine Bencherchali (Nextron Systems)

Created

2022-06-10

Data Sources

windowsFile Events

Platforms

windows

References

https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/

Tags

attack.persistence

Raw Content

title: Potential Persistence Via Notepad++ Plugins
id: 54127bd4-f541-4ac3-afdb-ea073f63f692
status: test
description: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence
references:
    - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-10
modified: 2025-09-01
tags:
    - attack.persistence
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '\Notepad++\plugins\'
        TargetFilename|endswith: '.dll'
    filter_gup:
        Image|endswith: '\Notepad++\updater\gup.exe'
    filter_install:
        # This filter is for Sigma dataset you could remove it or change when using the rule in your own env
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Temp\'
        Image|endswith:
            - '\target.exe'
            - 'Installer.x64.exe'
    filter_main_installer:
        Image|contains: '\npp.'
        Image|endswith: '.exe'
        TargetFilename:
            - 'C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll'
            - 'C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll'
            - 'C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll'
            - 'C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll'
    condition: selection and not 1 of filter_*
falsepositives:
    - Possible FPs during first installation of Notepad++
    - Legitimate use of custom plugins by users in order to enhance notepad++ functionalities
level: medium