Sigma rule: Notepad++ Updater DNS Query to Uncommon Domains

Rule

Title

Notepad++ Updater DNS Query to Uncommon Domains

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-02-02

Modified

2026-03-16

File

rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.

Log source

product

windows

category

dns_query

Detection

selection:
    Image|endswith: '\gup.exe'
filter_main_notepad_legit_domain:
    QueryName: 'notepad-plus-plus.org'
filter_optional_sourceforge_legit_domain:
    QueryName|endswith: '.sourceforge.net'
filter_optional_github_legit_domain:
    - QueryName|endswith: '.githubusercontent.com'
    - QueryName: 'github.com'
filter_optional_google_storage_legit_domain:
    QueryName|endswith: '.googleapis.com'
filter_optional_uncommon_domains:
    QueryName|endswith:
        - '.azurewebsites.net'
        - 'block.opendns.com'
        - 'gateway.zscalerthree.net'
# Add other known legitimate domains if any
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.
• Other legitimate query to official domains not listed in the filter, needing tuning.

Tags

• attack.collection
• attack.credential-access
• attack.t1195.002
• attack.initial-access
• attack.t1557

MITRE ATT&CK ids this rule names

• T1195.002
• T1557

References

• https://notepad-plus-plus.org/news/v889-released/
• https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
• https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
• https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
• https://securelist.com/notepad-supply-chain-attack/118708/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml