{"id":"2074e137-1b73-4e2d-88ba-5a3407dbdce0","title":"Notepad++ Updater DNS Query to Uncommon Domains","description":"Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.\nThis could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-02-02","modified":"2026-03-16","tags":["attack.collection","attack.credential-access","attack.t1195.002","attack.initial-access","attack.t1557"],"technique_ids":["T1195.002","T1557"],"logsource":{"category":"dns_query","product":"windows"},"falsepositives":["Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.","Other legitimate query to official domains not listed in the filter, needing tuning."],"references":["https://notepad-plus-plus.org/news/v889-released/","https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html","https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/","https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/","https://securelist.com/notepad-supply-chain-attack/118708/"],"source_path":"rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml","source_sha256":"1ec6a7af284582fa55ce79ce84e39fc1e98cb148f4489afe16cfe23fce721f5f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Notepad++ Updater DNS Query to Uncommon Domains\nid: 2074e137-1b73-4e2d-88ba-5a3407dbdce0\nstatus: experimental\ndescription: |\n    Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.\n    This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.\nreferences:\n    - https://notepad-plus-plus.org/news/v889-released/\n    - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html\n    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/\n    - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/\n    - https://securelist.com/notepad-supply-chain-attack/118708/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-02-02\nmodified: 2026-03-16\ntags:\n    - attack.collection\n    - attack.credential-access\n    - attack.t1195.002\n    - attack.initial-access\n    - attack.t1557\nlogsource:\n    category: dns_query\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\gup.exe'\n    filter_main_notepad_legit_domain:\n        QueryName: 'notepad-plus-plus.org'\n    filter_optional_sourceforge_legit_domain:\n        QueryName|endswith: '.sourceforge.net'\n    filter_optional_github_legit_domain:\n        - QueryName|endswith: '.githubusercontent.com'\n        - QueryName: 'github.com'\n    filter_optional_google_storage_legit_domain:\n        QueryName|endswith: '.googleapis.com'\n    filter_optional_uncommon_domains:\n        QueryName|endswith:\n            - '.azurewebsites.net'\n            - 'block.opendns.com'\n            - 'gateway.zscalerthree.net'\n    # Add other known legitimate domains if any\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.\n    - Other legitimate query to official domains not listed in the filter, needing tuning.\nlevel: medium # can be upgraded to high after tuning with known legitimate DNS queries\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1195.002","id":"T1195.002","name":"Compromise Software Supply Chain","page":"techniques/enterprise/T1195.002/"},{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","page":"techniques/enterprise/T1557/"}],"data_path":"data/detection-rules/2074e137-1b73-4e2d-88ba-5a3407dbdce0.json","kind":"sigma"}