LunchPoke Malware: Detecting Notepad++ Plugin Abuse & Persistence

---
title: Potential LunchPoke Malware Execution via Notepad++ Plugin
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the execution of the LunchPoke utility, which masquerades as a Notepad++ plugin. This rule targets process creation events containing the LunchPoke name or originating from the plugins directory.
references:
  - https://cert.gov.ua/article/37611
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204
  - attack.persistence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - '\plugins\'
    Image|contains:
      - 'LunchPoke'
  selection_cli:
    CommandLine|contains:
      - 'LunchPoke'
  condition: 1 of selection_
falsepositives:
  - Legitimate third-party plugins (unlikely given specific name)
level: high
---
title: Suspicious Scheduled Task Created by Notepad++ Process
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the creation of a scheduled task by Notepad++, which may indicate plugin abuse like LunchPoke attempting to establish persistence.
references:
  - https://cert.gov.ua/article/37611
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    SubjectUserName|contains: 'Notepad++'
    CommandLine|contains:
      - 'schtasks' 
      - '/create'
  condition: selection
falsepositives:
  - Administrative automation using Notepad++
level: medium

// Hunt for LunchPoke execution and plugin persistence mechanisms
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "LunchPoke.exe" 
   or FolderPath contains @"\plugins\LunchPoke"
   or (InitiatingProcessFileName =~ "notepad++.exe" and CommandLine contains @"/create")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, CommandLine, InitiatingProcessFileName, SHA256
| order by Timestamp desc

-- Hunt for LunchPoke artifacts on disk
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="C:\Program Files\Notepad++\plugins\**\LunchPoke*")
WHERE Mtime > now() - 30d

-- Check for suspicious scheduled tasks linked to the plugin
SELECT TaskName, Action, Args, Author
FROM scheduler_tasks(schtask_exe="C:\Windows\System32\schtasks.exe")
WHERE Action =~ "LunchPoke" OR Args =~ "plugins"

# LunchPoke Remediation Script
# Requires Administrator privileges

Write-Host "[+] Starting scan for LunchPoke malicious plugin..." -ForegroundColor Cyan

$pathsToScan = @(
    "C:\Program Files\Notepad++\plugins",
    "${env:LOCALAPPDATA}\Programs\Notepad++\plugins",
    "C:\Program Files (x86)\Notepad++\plugins"
)

$maliciousFiles = @()

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Write-Host "[+] Scanning $path..." -ForegroundColor Yellow
        $files = Get-ChildItem -Path $path -Recurse -Filter "*LunchPoke*" -ErrorAction SilentlyContinue
        if ($files) {
            $maliciousFiles += $files
        }
    }
}

if ($maliciousFiles.Count -gt 0) {
    Write-Host "[!] THREAT DETECTED: Found LunchPoke related files." -ForegroundColor Red
    foreach ($file in $maliciousFiles) {
        Write-Host "    - Removing: $($file.FullName)" -ForegroundColor Yellow
        try {
            Remove-Item -Path $file.FullName -Force -ErrorAction Stop
        } catch {
            Write-Host "[!] Failed to remove $($file.FullName): $_" -ForegroundColor Red
        }
    }
} else {
    Write-Host "[-] No LunchPoke files found in standard plugin directories." -ForegroundColor Green
}

# Check for Suspicious Scheduled Tasks
Write-Host "[+] Checking Scheduled Tasks for LunchPoke persistence..." -ForegroundColor Cyan

try {
    $tasks = Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*LunchPoke*" -or $_.Actions.WorkingDirectory -like "*plugins*" }
    
    if ($tasks) {
        Write-Host "[!] Suspicious tasks found:" -ForegroundColor Red
        foreach ($task in $tasks) {
            Write-Host "    - Unregistering Task: $($task.TaskName)" -ForegroundColor Yellow
            Unregister-ScheduledTask -TaskName $task.TaskName -Confirm:$false
        }
    } else {
        Write-Host "[-] No suspicious tasks found." -ForegroundColor Green
    }
} catch {
    Write-Host "[!] Error checking scheduled tasks: $_" -ForegroundColor Red
}

Write-Host "[+] Remediation complete. Please review Notepad++ installation source." -ForegroundColor Green