N
Low RiskWindowsLegitimateCommonly Abusednotepad.exeTEXT EDITORnotepad.exe - Windows Notepad Security Analysis
notepad.exe is the Windows text editor, a ubiquitous and trusted application. While typically benign, attackers use notepad.exe as a process injection target due to its trusted status and for testing code execution (spawning notepad to verify RCE). Notepad spawned from unusual parents is suspicious.
Risk Summary
LOW priority for SOC triage. notepad.exe is typically benign but is used as a test target for code execution and process injection. Monitor for notepad spawned from unexpected parents like web servers or services.
Overview
What is notepad.exe?
notepad.exe is the built-in Windows text editor.
Core Functions
Text Editing:
- Simple text file editing
- View text files
Security Significance
Normal Behavior
Normal Behavior
Expected Process State
| Property | Expected Value |
|---|---|
| Path | C:\Windows\System32\notepad.exe |
| Parent | explorer.exe (user launch) |
| User | Logged-in user |
| Network | None |
Normal Launch
explorer.exe → notepad.exe
Common Locations
C:\Windows\System32\notepad.exeC:\Windows\SysWOW64\notepad.exeC:\Windows\notepad.exeSuspicious Indicators
Legitimate vs Suspicious
LEGITIMATE
Path: C:\Windows\System32\notepad.exe
Parent: explorer.exe
Network: None
User: Logged-in user
SUSPICIOUS
Parent: w3wp.exe (webshell!)
svchost.exe
services.exe
Path: C:\Temp\notepad.exe
Network: Any (abnormal)
Abuse Techniques
Attack Techniques
Technique #1: Code Execution Verification (T1106)
Attackers spawn notepad to verify RCE:
start notepad.exe
Technique #2: Process Injection Target (T1055)
Injecting code into notepad.exe:
- Trusted process
- Rarely monitored
Technique #3: Process Masquerading (T1036.005)
Malware named notepad.exe.
Detection Guidance
Detection Strategies
Priority #1: Unusual Parent Process
Process = "notepad.exe" AND
Parent IN ["w3wp.exe", "httpd.exe", "java.exe"]
→ ALERT: CRITICAL - Possible RCE
Priority #2: Network Activity
Process = "notepad.exe" AND
NetworkConnection = true
→ ALERT: HIGH - Notepad shouldn't network
Remediation Steps
Protection and Remediation
Defense: Monitor Unusual Parents
Alert on notepad from web server processes.
If Compromise Suspected
- Check parent process
- Look for webshell indicators
- Review for process injection
Investigation Checklist
Investigation Checklist
- Check parent process
- Verify path is System32
- Check for network activity
- Look for injection indicators