Sigma rule: Uncommon File Created by Notepad++ Updater Gup.EXE

Rule

Title

Uncommon File Created by Notepad++ Updater Gup.EXE

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-02-03

Modified

2026-03-16

File

rules/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith: '\gup.exe'
filter_main_legit_paths:
    TargetFilename|startswith:
        - 'C:\Program Files\Notepad++\'
        - 'C:\Program Files (x86)\Notepad++\'
filter_main_temp_update_installer:
    TargetFilename|startswith: 'C:\Users\'
    TargetFilename|contains|all:
        - '\AppData\Local\Temp\'
        - 'npp.'
        - '.Installer.'
        - '.exe'
filter_main_temp_generic_zip:
    TargetFilename|startswith: 'C:\Users\'
    TargetFilename|contains|all:
        - '\AppData\Local\Temp\'
        - '.zip'
filter_main_recycle_bin:
    TargetFilename|startswith: 'C:\$Recycle.Bin\S-1-5-21'
filter_main_plugins:
    - TargetFilename|contains:
          - '\plugins\JsonTools\testfiles\'
          - '\Notepad++\plugins\ComparePlugin\'
    - TargetFilename|contains|all:
          - 'npp.'
          - '.portable.'
          - '\plugins\'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Custom or portable Notepad++ installations in non-standard directories.
• Legitimate update processes creating temporary files in unexpected locations.

Tags

• attack.collection
• attack.credential-access
• attack.t1195.002
• attack.initial-access
• attack.t1557

MITRE ATT&CK ids this rule names

• T1195.002
• T1557

References

• https://notepad-plus-plus.org/news/v889-released/
• https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
• https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
• https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
• https://securelist.com/notepad-supply-chain-attack/118708/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml