J S
@jsh0xCompletionist
3 followers44 downloads341 copies26 likes112,708 views
8 detections
Filters
Last updated
All Time
Detection languages
7
1
Categories
5
4
2
1
1
Platforms
8
Products / Services
4
MITRE Techniques
4
4
3
2
2
Detects Notepad++ installer and portable files where the file hash does not match a list of known legitimate hashes. This could indicate a malicious file masquerading as Notepad++.
Detects a sequence of events associated with a malicious Notepad++ update. This malicious process executes reconnaissance commands.
Detects the use of curl.exe to upload data to the temp.sh file-sharing service. This technique has been observed in post-compromise reconnaissance activities, including those following Notepad++ compromises.
Detects the execution of 'AutoUpdater.exe' or 'update.exe' with the '/closeRunningNpp' flag. This specific behavior has been observed in hijacked Notepad++ update flows where a malicious binary masquerades as the legitimate updater. 'AutoUpdater.exe' is not a legitimate Notepad++ file.
Detects the Notepad++ updater process (gup.exe) making network connections to domains other than the official Notepad++ or GitHub domains. This could indicate a compromised update process or a supply chain attack where the updater is redirected to a malicious download location.
Detects the Notepad++ updater process (gup.exe) spawning unusual child processes. Attackers have been observed hijacking the update process to execute malicious payloads.
Detects suspicious process creation where a web browser spawns a command interpreter or scripting host. This behavior is indicative of the "FileFix" attack, where users are socially engineered to paste malicious commands into the File Explorer address bar opened by a browser's file upload functionality.
Detects suspicious process creation where a web browser spawns a command interpreter or scripting host. This behavior is indicative of the "FileFix" attack, where users are socially engineered to paste malicious commands into the File Explorer address bar opened by a browser's file upload functionality.