Notepad++ Remote Network Connections

Kenji Choy@kchoy

•updated Feb 3, 2026•15•0•22,101

This query identifies outbound network connections made by the notepad++.exe process. This is useful for hunting for suspicious activity, such as connections to malicious update servers or C2 channels, by baselining normal update and plugin activity.