Suspicious Child Process of Notepad++ Updater - GUP.Exe

calendar Feb 4, 2026 · attack.collection attack.credential-access attack.t1195.002 attack.initial-access attack.t1557  ·
Share on: linkedin copy

Detects suspicious child process creation by the Notepad++ updater process (gup.exe). This could indicate potential exploitation of the updater component to deliver unwanted malware.

Sigma rule (View on GitHub)

 1title: Suspicious Child Process of Notepad++ Updater - GUP.Exe
 2id: bb0e87ce-c89f-4857-84fa-095e4483e9cb
 3status: experimental
 4description: |
 5    Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
 6    This could indicate potential exploitation of the updater component to deliver unwanted malware.    
 7references:
 8    - https://notepad-plus-plus.org/news/v889-released/
 9    - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
10    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
11    - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
12    - https://securelist.com/notepad-supply-chain-attack/118708/
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2026-02-03
15tags:
16    - attack.collection
17    - attack.credential-access
18    - attack.t1195.002
19    - attack.initial-access
20    - attack.t1557
21logsource:
22    category: process_creation
23    product: windows
24detection:
25    selection_parent:
26        ParentImage|endswith: '\gup.exe'
27    selection_child_img:
28        Image|endswith:
29            - '\cmd.exe'
30            - '\powershell.exe'
31            - '\pwsh.exe'
32            - '\cscript.exe'
33            - '\wscript.exe'
34            - '\mshta.exe'
35    selection_child_cli:
36        CommandLine|contains:
37            - 'bitsadmin'
38            - 'certutil'
39            - 'curl'
40            - 'finger'
41            - 'forfiles'
42            - 'regsvr32'
43            - 'rundll32'
44            - 'wget'
45    condition: selection_parent and 1 of selection_child_*
46falsepositives:
47    - Unlikely
48level: high

References

Related rules

to-top