Notepad++ Updater Reconnaissance and DLL Sideloading
This rule detects suspicious activity related to Notepad++ updater (gup.exe or update.exe) executing reconnaissance commands or loading suspicious DLLs. Specifically, it looks for the updater process initiating common reconnaissance tools like cmd.exe, powershell.exe, or curl.exe with commands such as 'whoami', 'tasklist', 'systeminfo', 'netstat', 'ipconfig', or 'curl' that include redirection for staging. Additionally, it correlates this activity with the loading of suspicious DLLs (e.g., log.dll) from unusual locations like AppData or Temp folders, potentially indicating DLL sideloading.
Microsoft Sentinel (KQL)
