TROJAN Notepad

Hunt Hypothesis

This detection identifies adversaries attempting to evade signature-based defenses by masquerading malicious payloads as benign Windows Notepad processes. Proactive hunting for this behavior in Azure Sentinel is critical because attackers frequently leverage legitimate system utilities like Notepad to execute initial command-and-control scripts or stage data exfiltration without triggering high-severity alerts.

YARA Rule

rule TROJAN_Notepad {
    meta:
        Author = "RSA_IR"
        Date     = "4Jun13"
        File     = "notepad.exe v 1.1"
        MD5      = "106E63DBDA3A76BEEB53A8BBD8F98927"
    strings:
        $s1 = "75BAA77C842BE168B0F66C42C7885997"
        $s2 = "B523F63566F407F3834BCC54AAA32524"
    condition:
        $s1 or $s2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the TROJAN Notepad detection rule in an enterprise environment, along with suggested filters or exclusions:

• IT Support Remote Troubleshooting via PowerShell/Notepad

  • Scenario: Helpdesk administrators frequently use notepad.exe to quickly view log files (e.g., .txt, .log) or edit configuration snippets while troubleshooting remote user sessions. This often occurs when a support agent opens a file directly from a network share path rather than launching the application via a standard shortcut, triggering the YARA rule on the process execution context.
  • Filter/Exclusion: Create an exclusion for notepad.exe processes launched by trusted service accounts (e.g., DOMAIN\HelpDesk_Admin) or specifically exclude file paths located under known network share roots (e.g., \\FileServer\SupportLogs\*).

• Automated Log Rotation and Archiving Scripts

  • Scenario: Scheduled tasks managed by tools like Microsoft System Center Configuration Manager (SCCM) or custom PowerShell scripts utilize Notepad to generate temporary manifests, read version files, or parse JSON/XML logs before archiving them. These jobs often run under the SYSTEM account or a dedicated service account (svc_log_archiver) and may spawn notepad.exe as a child process of powershell.exe or taskeng.exe.
  • Filter/Exclusion: Exclude notepad.exe instances where the parent process is taskeng.exe, powershell.exe, or ccmexec.exe. Additionally, filter for execution times that align with known maintenance windows (e.g., 02:00 – 04:00 UTC).

• Software Deployment and Configuration Updates

  • Scenario: During the deployment of enterprise applications using tools like Ansible, Chef,