Network Connection Initiated Via Notepad.EXE
This rule detects when the 'notepad.exe' process initiates a network connection. This behavior is highly unusual for Notepad and can indicate malicious activity such as process injection where a beacon or other malicious code is running within the legitimate Notepad process to establish command and control. Notepad typically only initiates network communication when printing documents, which is filtered out by this rule.
Sigma
