Hayabusa high test sigma

Network Connection Initiated Via Notepad.EXE

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

View Source

Detection Logic

{
  "network_connection": {
    "EventID": 3,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "Image
| endswith": "\\notepad.exe"
  },
  "filter_optional_printing": {
    "DestinationPort": 9100
  },
  "condition": "network_connection and (selection and not 1 of filter_optional_*)"
}

False Positives

⚠ Printing documents via notepad might cause communication with the printer via port 9100 or similar.

Field Validations

Loading…

Comments (0)

Loading comments...