Uncommon File Created by Notepad++ Updater Gup.EXE

calendar Feb 4, 2026 · attack.collection attack.credential-access attack.t1195.002 attack.initial-access attack.t1557  ·
Share on: linkedin copy

Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.

Sigma rule (View on GitHub)

 1title: Uncommon File Created by Notepad++ Updater Gup.EXE
 2id: 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
 3status: experimental
 4description: |
 5    Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
 6    This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.    
 7references:
 8    - https://notepad-plus-plus.org/news/v889-released/
 9    - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
10    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
11    - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
12    - https://securelist.com/notepad-supply-chain-attack/118708/
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2026-02-03
15tags:
16    - attack.collection
17    - attack.credential-access
18    - attack.t1195.002
19    - attack.initial-access
20    - attack.t1557
21logsource:
22    category: file_event
23    product: windows
24detection:
25    selection:
26        Image|endswith: '\gup.exe'
27    filter_main_legit_paths:
28        TargetFilename|startswith:
29            - 'C:\Program Files\Notepad++\'
30            - 'C:\Program Files (x86)\Notepad++\'
31    filter_main_temp_update_installer:
32        TargetFilename|startswith: 'C:\Users\'
33        TargetFilename|contains|all:
34            - '\AppData\Local\Temp\'
35            - 'npp.'
36            - '.Installer.'
37            - '.exe'
38    filter_main_temp_generic_zip:
39        TargetFilename|startswith: 'C:\Users\'
40        TargetFilename|contains|all:
41            - '\AppData\Local\Temp\'
42            - '.zip'
43    filter_main_recycle_bin:
44        TargetFilename|startswith: 'C:\$Recycle.Bin\S-1-5-21'
45    condition: selection and not 1 of filter_main_*
46falsepositives:
47    - Custom or portable Notepad++ installations in non-standard directories.
48    - Legitimate update processes creating temporary files in unexpected locations.
49level: high

References

Related rules

to-top