Notepad process makes a network connection

BIOC Low

Notepad process makes a network connection

Notepad.exe processes should not normally make network connections (with the occasional exception of printing documents). This can be a possible indicator of exploitation, e.g. Metasploit Meterpreter injection.

Module:: Platform Analytics
Agent event type:: Network
Category:: Exfiltration
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Process Injection (T1055)

Indicator:

Network action type = incoming , outgoing , failed Process os parent name = notepad.exe

Preventable: yes