Potential Persistence Via Notepad++ Plugins

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•1•0•25

Detects the creation of new DLL files within the Notepad++ plugins directory by any process other than 'gup.exe' or the main installer. This activity could indicate an attempt to establish persistence on the system by injecting malicious plugins into Notepad++.