Notepad Password Files Discovery

Title: Notepad Password Files Discovery
Status: experimental
Description:Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.
References:
  -https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
  -https://intel.thedfirreport.com/eventReports/view/57
Author: The DFIR Report
Date: 2025-02-21
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1083'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith: '\notepad.exe'
    CommandLine|endswith:
      -'password*.txt'
      -'password*.csv'
      -'password*.doc'
      -'password*.xls'

  condition:selection
Falsepositives:
  -Legitimate use of opening files from remote hosts by administrators or users. However, storing passwords in text readable format could potentially be a violation of the organization's policy. Any match should be investigated further.
Level: low