Notepad++ Updater DNS Query to Uncommon Domains

calendar Feb 4, 2026 · attack.collection attack.credential-access attack.t1195.002 attack.initial-access attack.t1557  ·
Share on: linkedin copy

Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.

Sigma rule (View on GitHub)

 1title: Notepad++ Updater DNS Query to Uncommon Domains
 2id: 2074e137-1b73-4e2d-88ba-5a3407dbdce0
 3status: experimental
 4description: |
 5    Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
 6    This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.    
 7references:
 8    - https://notepad-plus-plus.org/news/v889-released/
 9    - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
10    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
11    - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
12    - https://securelist.com/notepad-supply-chain-attack/118708/
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2026-02-02
15tags:
16    - attack.collection
17    - attack.credential-access
18    - attack.t1195.002
19    - attack.initial-access
20    - attack.t1557
21logsource:
22    category: dns_query
23    product: windows
24detection:
25    selection:
26        Image|endswith: '\gup.exe'
27    filter_main_notepad_legit_domain:
28        QueryName: 'notepad-plus-plus.org'
29    filter_optional_sourceforge_legit_domain:
30        QueryName|endswith: '.sourceforge.net'
31    filter_optional_github_legit_domain:
32        - QueryName|endswith: '.githubusercontent.com'
33        - QueryName: 'github.com'
34    filter_optional_google_storage_legit_domain:
35        QueryName|endswith: '.googleapis.com'
36    # Add other known legitimate domains if any
37    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
38falsepositives:
39    - Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.
40    - Other legitimate query to official domains not listed in the filter, needing tuning.
41level: medium # can be upgraded to high after tuning with known legitimate DNS queries

References

Related rules

to-top