{"id":"bb0e87ce-c89f-4857-84fa-095e4483e9cb","title":"Suspicious Child Process of Notepad++ Updater - GUP.Exe","description":"Detects suspicious child process creation by the Notepad++ updater process (gup.exe).\nThis could indicate potential exploitation of the updater component to deliver unwanted malware.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-02-03","modified":"","tags":["attack.collection","attack.credential-access","attack.t1195.002","attack.initial-access","attack.t1557"],"technique_ids":["T1195.002","T1557"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://notepad-plus-plus.org/news/v889-released/","https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html","https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/","https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/","https://securelist.com/notepad-supply-chain-attack/118708/"],"source_path":"rules/windows/process_creation/proc_creation_win_gup_susp_child_process.yml","source_sha256":"0d2b51abae9850b054d7a5e6a7a94ad7f3bbbec8e5e3ba35075c99a5a03ccfb8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_gup_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Child Process of Notepad++ Updater - GUP.Exe\nid: bb0e87ce-c89f-4857-84fa-095e4483e9cb\nstatus: experimental\ndescription: |\n    Detects suspicious child process creation by the Notepad++ updater process (gup.exe).\n    This could indicate potential exploitation of the updater component to deliver unwanted malware.\nreferences:\n    - https://notepad-plus-plus.org/news/v889-released/\n    - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html\n    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/\n    - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/\n    - https://securelist.com/notepad-supply-chain-attack/118708/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-02-03\ntags:\n    - attack.collection\n    - attack.credential-access\n    - attack.t1195.002\n    - attack.initial-access\n    - attack.t1557\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\gup.exe'\n    selection_child_img:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\cscript.exe'\n            - '\\wscript.exe'\n            - '\\mshta.exe'\n    selection_child_cli:\n        CommandLine|contains:\n            - 'bitsadmin'\n            - 'certutil'\n            - 'curl'\n            - 'finger'\n            - 'forfiles'\n            - 'regsvr32'\n            - 'rundll32'\n            - 'wget'\n    condition: selection_parent and 1 of selection_child_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1195.002","id":"T1195.002","name":"Compromise Software Supply Chain","page":"techniques/enterprise/T1195.002/"},{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","page":"techniques/enterprise/T1557/"}],"data_path":"data/detection-rules/bb0e87ce-c89f-4857-84fa-095e4483e9cb.json","kind":"sigma"}