Windows Suspect Notepadpp Maliciousupdater Tempsh Ua Exfil

Daniel Jeremiah@daniyyell

•updated Feb 22, 2026•3•0•43

This rule detects suspicious activity related to a malicious Notepad++ updater, specifically looking for command strings that indicate data exfiltration to 'temp.sh' using 'curl.exe'. It identifies the presence of 'temp.sh/upload', '--user-agent', 'temp.sh/', '/list', and 'curl.exe' within the analyzed content, suggesting an attempt to upload data or list contents to a temporary sharing service.