Reconnaissance Command Sequence to File (Notepad++ Supply Chain Attack TTP)

nomit vyas@xoxo

•updated Jun 23, 2026•1•0•5

Detects a sequence of reconnaissance commands (whoami, tasklist, systeminfo, netstat) executed by the command prompt and piped to a text file. This specific TTP was used in the Notepad++ supply chain attack to gather system information for exfiltration. The detection is scoped to specific AppData directories to reduce false positives.