{"id":"3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09","title":"Uncommon File Created by Notepad++ Updater Gup.EXE","description":"Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.\nThis could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-02-03","modified":"2026-03-16","tags":["attack.collection","attack.credential-access","attack.t1195.002","attack.initial-access","attack.t1557"],"technique_ids":["T1195.002","T1557"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Custom or portable Notepad++ installations in non-standard directories.","Legitimate update processes creating temporary files in unexpected locations."],"references":["https://notepad-plus-plus.org/news/v889-released/","https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html","https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/","https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/","https://securelist.com/notepad-supply-chain-attack/118708/"],"source_path":"rules/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml","source_sha256":"10ddee1298eb1a856ffde770595481ccf885aec9194ea8fe7d6295ddd7e3e453","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Uncommon File Created by Notepad++ Updater Gup.EXE\nid: 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09\nstatus: experimental\ndescription: |\n    Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.\n    This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.\nreferences:\n    - https://notepad-plus-plus.org/news/v889-released/\n    - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html\n    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/\n    - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/\n    - https://securelist.com/notepad-supply-chain-attack/118708/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-02-03\nmodified: 2026-03-16\ntags:\n    - attack.collection\n    - attack.credential-access\n    - attack.t1195.002\n    - attack.initial-access\n    - attack.t1557\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\gup.exe'\n    filter_main_legit_paths:\n        TargetFilename|startswith:\n            - 'C:\\Program Files\\Notepad++\\'\n            - 'C:\\Program Files (x86)\\Notepad++\\'\n    filter_main_temp_update_installer:\n        TargetFilename|startswith: 'C:\\Users\\'\n        TargetFilename|contains|all:\n            - '\\AppData\\Local\\Temp\\'\n            - 'npp.'\n            - '.Installer.'\n            - '.exe'\n    filter_main_temp_generic_zip:\n        TargetFilename|startswith: 'C:\\Users\\'\n        TargetFilename|contains|all:\n            - '\\AppData\\Local\\Temp\\'\n            - '.zip'\n    filter_main_recycle_bin:\n        TargetFilename|startswith: 'C:\\$Recycle.Bin\\S-1-5-21'\n    filter_main_plugins:\n        - TargetFilename|contains:\n              - '\\plugins\\JsonTools\\testfiles\\'\n              - '\\Notepad++\\plugins\\ComparePlugin\\'\n        - TargetFilename|contains|all:\n              - 'npp.'\n              - '.portable.'\n              - '\\plugins\\'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Custom or portable Notepad++ installations in non-standard directories.\n    - Legitimate update processes creating temporary files in unexpected locations.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1195.002","id":"T1195.002","name":"Compromise Software Supply Chain","page":"techniques/enterprise/T1195.002/"},{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","page":"techniques/enterprise/T1557/"}],"data_path":"data/detection-rules/3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09.json","kind":"sigma"}