Potential FIN7 Exploitation Activity via Notepad++ and RDP
This rule detects suspicious process creation patterns that may indicate FIN7 exploitation activity. Specifically, it looks for `cmd.exe` being spawned by `notepad++.exe` or `notepad++.exe` being spawned by `rdpinit.exe`. These process relationships are indicative of potential post-exploitation actions after initial access, possibly via compromised RDP credentials as described in the referenced Google blog.
Sigma
