Notepad++ Download of Code Without Integrity Check (CVE-2025-15556)

let NotepadPlusProcesses = DeviceProcessEvents
| where FileName =~ "notepad++.exe" or InitiatingProcessFileName =~ "notepad++.exe"
| project DeviceId, DeviceName, Timestamp, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let NotepadPlusNetworkEvents = DeviceNetworkEvents
| where InitiatingProcessFileName =~ "notepad++.exe"
| where RemoteUrl !has "notepad-plus-plus.org" or ActionType == "ConnectionFailed"
| project DeviceId, DeviceName, Timestamp, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine;
let SuspiciousFileWrites = DeviceFileEvents
| where InitiatingProcessFileName =~ "notepad++.exe"
| where (FolderPath contains "\\plugins\\" or FolderPath contains "\\updater\\" or FolderPath endswith ".dll" or FolderPath endswith ".exe")
| project DeviceId, DeviceName, Timestamp, FileName, FolderPath, SHA256, InitiatingProcessFileName;
let ChildProcesses = DeviceProcessEvents
| where InitiatingProcessFileName =~ "notepad++.exe"
| where FileName !in~ ("notepad++.exe", "GUP.exe", "explorer.exe")
| project DeviceId, DeviceName, Timestamp, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName;
union kind=outer NotepadPlusNetworkEvents, SuspiciousFileWrites, ChildProcesses
| summarize Count=count(), Events=make_set(pack("type", $left.RemoteUrl, "file", $left.FolderPath, "proc", $left.FileName), 10) by DeviceId, DeviceName, bin(Timestamp, 1h)
| where Count >= 1
| order by Timestamp desc

index=* sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=crowdstrike:events:sensor
| eval process_name=lower(coalesce(process_name, Image, ParentImage))
| eval parent_name=lower(coalesce(parent_process_name, ParentImage))
| where process_name="notepad++.exe" OR parent_name="notepad++.exe"
| eval event_type=case(
    EventCode=1 AND parent_name="notepad++.exe" AND process_name!="notepad++.exe" AND process_name!="gup.exe", "suspicious_child_process",
    EventCode=3 AND process_name="notepad++.exe", "network_connection",
    EventCode=11 AND (process_name="notepad++.exe") AND (match(TargetFilename, "(?i)\\plugins\\") OR match(TargetFilename, "(?i)\\updater\\") OR match(TargetFilename, "(?i)\.(dll|exe)$")), "file_write",
    true(), "other"
)
| where event_type IN ("suspicious_child_process", "network_connection", "file_write")
| stats count as event_count, values(event_type) as event_types, values(DestinationIp) as dest_ips, values(TargetFilename) as files_written, values(process_name) as child_procs by Computer, user, _time
| where event_count >= 1
| sort -_time

sequence by host.name with maxspan=5m
  [process where process.name : "notepad++.exe" and event.type == "start"]
  [any where
    (
      /* Suspicious network connection from notepad++ */
      (event.category == "network" and process.name : "notepad++.exe" and
       not destination.domain : ("*.notepad-plus-plus.org", "notepad-plus-plus.org"))
      or
      /* Child process spawned by notepad++ */
      (event.category == "process" and process.parent.name : "notepad++.exe" and
       not process.name : ("notepad++.exe", "GUP.exe", "conhost.exe"))
      or
      /* File write to plugin or updater directory */
      (event.category == "file" and process.name : "notepad++.exe" and
       file.path : ("*\\plugins\\*", "*\\updater\\*") and
       file.extension : ("dll", "exe"))
    )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  devicehostname AS host,
  username,
  sourceip,
  destinationip,
  destinationhostname,
  "Application",
  QIDNAME(qid) AS event_name,
  payload
FROM events
WHERE
  LOWER("Application") LIKE '%notepad++%'
  AND (
    (LOWER(category) = 'network connection' AND destinationhostname NOT LIKE '%notepad-plus-plus.org%')
    OR (LOWER(category) = 'process creation' AND "parentprocessname" LIKE '%notepad++.exe%' AND LOWER("Application") NOT IN ('notepad++.exe', 'gup.exe', 'conhost.exe'))
    OR (LOWER(category) = 'file created' AND ("targetfilepath" LIKE '%\plugins\%' OR "targetfilepath" LIKE '%\updater\%') AND ("targetfilepath" LIKE '%.dll' OR "targetfilepath" LIKE '%.exe'))
  )
  AND LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
LAST 24 HOURS

_sourceCategory=endpoint/windows/sysmon OR _sourceCategory=endpoint/crowdstrike
| json field=_raw "EventID" as event_id nodrop
| json field=_raw "Image" as image nodrop
| json field=_raw "ParentImage" as parent_image nodrop
| json field=_raw "DestinationHostname" as dest_host nodrop
| json field=_raw "TargetFilename" as target_file nodrop
| where (toLowerCase(image) contains "notepad++.exe" or toLowerCase(parent_image) contains "notepad++.exe")
| eval suspicious_network = if(event_id="3" and toLowerCase(image) contains "notepad++.exe" and !matches(dest_host, ".*notepad-plus-plus\\.org.*"), 1, 0)
| eval suspicious_child = if(event_id="1" and toLowerCase(parent_image) contains "notepad++.exe" and !matches(toLowerCase(image), ".*(notepad\\+\\+|gup|conhost).*"), 1, 0)
| eval suspicious_file = if(event_id="11" and toLowerCase(image) contains "notepad++.exe" and (matches(target_file, "(?i).*\\\\plugins\\\\.*") or matches(target_file, "(?i).*\\\\updater\\\\.*")) and (matches(target_file, "(?i).*\\.(dll|exe)$")), 1, 0)
| where suspicious_network=1 or suspicious_child=1 or suspicious_file=1
| fields _sourceHost, _sourceCategory, event_id, image, parent_image, dest_host, target_file, suspicious_network, suspicious_child, suspicious_file
| sort by _messagetime desc

rule cve_2025_15556_notepadplusplus_integrity_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-15556: Notepad++ download of code without integrity check"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15556"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    (
      // Notepad++ spawning unexpected child processes
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e1.principal.process.file.full_path, `(?i)notepad\+\+\.exe`)
      and not re.regex($e1.target.process.file.full_path, `(?i)(notepad\+\+|GUP|conhost|cmd)\.exe`)
    )
    or
    (
      // Notepad++ making network connections to non-official hosts
      $e1.metadata.event_type = "NETWORK_CONNECTION"
      and re.regex($e1.principal.process.file.full_path, `(?i)notepad\+\+\.exe`)
      and not re.regex($e1.target.hostname, `(?i)(notepad-plus-plus\.org|localhost|127\.0\.0\.1)`)
    )
    or
    (
      // Notepad++ writing executables to plugin/updater directories
      $e1.metadata.event_type = "FILE_CREATION"
      and re.regex($e1.principal.process.file.full_path, `(?i)notepad\+\+\.exe`)
      and re.regex($e1.target.file.full_path, `(?i)(\\plugins\\|\\updater\\)`)
      and re.regex($e1.target.file.full_path, `(?i)\.(dll|exe)$`)
    )

  condition:
    $e1
}

#event_simpleName IN (ProcessRollup2, NetworkConnectIP4, NetworkConnectIP6, FileOpenInfo)
| ParentBaseFileName = "notepad++.exe" OR ImageFileName = "*notepad++.exe"
| eval event_category = case(
    #event_simpleName = "ProcessRollup2" AND ParentBaseFileName = "notepad++.exe" AND ImageFileName != "*notepad++.exe" AND ImageFileName != "*GUP.exe" AND ImageFileName != "*conhost.exe", "suspicious_child_process",
    #event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6") AND ImageFileName = "*notepad++.exe" AND RemoteAddressIP4 != "127.0.0.1", "suspicious_network",
    #event_simpleName = "FileOpenInfo" AND ImageFileName = "*notepad++.exe" AND (TargetFileName = "*\plugins\*" OR TargetFileName = "*\updater\*") AND (TargetFileName = "*.dll" OR TargetFileName = "*.exe"), "suspicious_file_write",
    true(), null
  )
| event_category != null
| stats count() as event_count, values(event_category) as categories, values(RemoteAddressIP4) as remote_ips, values(TargetFileName) as target_files, values(ImageFileName) as child_procs by ComputerName, UserName, aid
| sort -event_count