Dropped renamed-binary sideload: Evernote.zip + notepad++.exe

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

This rule detects potential dropper activity associated with the TrustSink/XHOPLESS threat actor, specifically involving an 'Evernote.zip' file staged in the C:\Users\Public directory. It monitors for the automated extraction of files (like a repurposed notepad++.exe) using VBScript's Shell.Application or WScript.Shell, which is indicative of a side-loading attack chain.