TROJAN Notepad shell crew

Hunt Hypothesis

This hunt targets adversaries attempting to evade detection by executing malicious shell scripts disguised as benign Notepad processes within the Azure environment. Proactively hunting for this behavior is essential because low-severity alerts often mask sophisticated living-off-the-land attacks that could establish persistent footholds before triggering higher-level incident responses.

YARA Rule

rule TROJAN_Notepad_shell_crew : Trojan {
        meta:
                author = "RSA_IR"
                Date     = "4Jun13"
                File     = "notepad.exe v 1.1"
                MD5      = "106E63DBDA3A76BEEB53A8BBD8F98927"
        strings:
                $s1 = "75BAA77C842BE168B0F66C42C7885997"
                $s2 = "B523F63566F407F3834BCC54AAA32524"
        condition:
                $s1 or $s2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the TROJAN Notepad shell crew detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated Log Parsing via Scheduled Tasks

  • Scenario: System administrators frequently use notepad.exe to generate temporary configuration snippets or parse logs before feeding them into a larger script. A scheduled task (e.g., running every morning at 08:00) might invoke Notepad with specific command-line arguments to open a template file in the %TEMP% directory, which mimics the behavior of a dropper creating a shell environment.
  • Filter/Exclusion: Exclude processes where notepad.exe is spawned by Task Scheduler Service (svchost.exe) or schtasks.exe and the command line contains standard administrative flags (e.g., /n, /a) rather than launching an executable payload from a user’s profile directory.

• IT Support Remote Assistance Sessions

  • Scenario: During remote troubleshooting sessions using tools like Microsoft Teams, Zoom, or TeamViewer, support agents often launch Notepad to display temporary IP configurations, DNS settings, or error codes to the end-user on screen. If the agent launches Notepad from a non-standard path (e.g., a mapped network drive used for shared scripts) while simultaneously initiating a shell command to copy text, it may trigger the “shell crew” logic.
  • Filter/Exclusion: Create an exclusion rule for notepad.exe instances where the parent process is a known remote desktop or collaboration client (e.g., MicrosoftTeams.exe, Zoom.exe) and the working directory matches the organization’s standard support tooling paths (e.g., C:\Program Files\RemoteSupportTools).

• Software Deployment and Patch Management

  • Scenario: Enterprise deployment tools like **Microsoft