Public-folder ZIP extraction, notepad++ execution, then archive deletion

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

This rule detects a malicious execution sequence often associated with VBScript droppers. It identifies the execution of a process (specifically notepad++.exe) from a dynamically named staging directory under C:\Users\Public\, followed within 10 minutes by the deletion of the associated staging archive (Evernote.zip).