notepad++.exe executed from Public user staging folder by wscript
Detects instances where the Notepad++ executable is launched from a location within the C:\Users\Public\ directory, specifically when the parent process is a Windows scripting engine (wscript.exe or cscript.exe). This pattern is often indicative of an adversary executing a malicious payload staged in a common public directory using script-based wrappers to bypass execution policy or maintain stealth.
Sigma
