Notepad Password Files Discovery

SigmaHQ Detections@sigmaHQ

•updated Mar 4, 2025•0•16

Detects the execution of Notepad to open a file that has the string "password" in its name and a common extension (txt, csv, doc, xls). This activity may indicate unauthorized access to credentials or suspicious reconnaissance.