Notepad++ Reconnaissance Command Sequence (Behavioral)

Daniel Miller@dxmiller

•updated Feb 2, 2026•11•0•120

This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).