Suspicious Notepad.exe Network Connection
Detects highly unusual network connections initiated by notepad.exe. This behavior is suspicious because notepad.exe is a simple text editor not designed for network communication. This technique has been observed in campaigns where threat actors inject shellcode into a suspended notepad.exe process to establish command and control (C2) connections.
Sigma
