Detecting Notepad++ CVE-2025-49144 via Sysmon

Step 1: Identifying Vulnerable Endpoints

Use Sysmon process creation events (Event ID 1) to locate hosts running outdated versions of Notepad++. Search for endpoints where the file version metadata does not match the patched release (8.8.2).

process_name:notepad\+\+.exe AND NOT file_version:8.8.2

Step 2: High-Signal Hunting Query

To detect active exploitation, we look for regsvr32.exe running with SYSTEM privileges from any location other than the standard Windows system folders, specifically when interacting with the Notepad++ shell component.

(((process_command_line: /.*[\\]contextMenu[\\]NppShell\.dll.*/)
AND (process_path: /.*[\\]regsvr32\.exe/)
AND (process_command_line: /regsvr32 \/s.*/))
AND NOT (process_path: (/C:[\\]Windows[\\]System32[\\]regsvr32\.exe/ 
OR /C:[\\]Windows[\\]SysWOW64[\\]regsvr32\.exe/)))

Step 3: Implementing a Sigma Rule

For automated detection, deploy the following Sigma rule to flag suspicious registration attempts across your Windows environment.

title: Potential Notepad++ CVE-2025-49144 Exploitation
status: experimental
description: Detects regsvr32.exe called without a full path by the Notepad++ installer.
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\regsvr32.exe'
        CommandLine|startswith: 'regsvr32 /s'
        CommandLine|contains: '\contextMenu\NppShell.dll'
    filter_legit:
        Image:
            - 'C:\Windows\System32\regsvr32.exe'
            - 'C:\Windows\SysWOW64\regsvr32.exe'
    condition: selection and not filter_legit
level: high

Final Takeaway

CVE-2025-49144 serves as a reminder that privilege escalation often hides in routine administrative workflows. By monitoring for SYSTEM executions occurring outside of System32, security teams can neutralize these threats before attackers establish persistence.