Timestomped DLL/Python files matching notepad.exe timestamp
This rule identifies instances where files with specific extensions (.dll, .py) or the python executable are created on a system shortly after (or exactly at) the observed creation timestamp of notepad.exe. This logic aims to detect potential masquerading or side-loading techniques where attackers may attempt to hide their activities or establish persistence by mimicking or piggybacking on standard utility usage.
Microsoft Sentinel (KQL)
