NotepadPlusPlus DLL Staged in AppData Roaming

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•1•0•3

This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (AppData\Roaming\Microsoft\Windows). This activity is suspicious as Notepad++ DLLs are not typically found in this location and could indicate an attempt at DLL side-loading or other forms of execution hijacking.