Sigma rule: Suspicious Child Process of Notepad++ Updater - GUP.Exe

Rule

Title

Suspicious Child Process of Notepad++ Updater - GUP.Exe

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-02-03

File

rules/windows/process_creation/proc_creation_win_gup_susp_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
This could indicate potential exploitation of the updater component to deliver unwanted malware.

Log source

product

windows

category

process_creation

Detection

selection_parent:
    ParentImage|endswith: '\gup.exe'
selection_child_img:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\cscript.exe'
        - '\wscript.exe'
        - '\mshta.exe'
selection_child_cli:
    CommandLine|contains:
        - 'bitsadmin'
        - 'certutil'
        - 'curl'
        - 'finger'
        - 'forfiles'
        - 'regsvr32'
        - 'rundll32'
        - 'wget'
condition: selection_parent and 1 of selection_child_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.collection
• attack.credential-access
• attack.t1195.002
• attack.initial-access
• attack.t1557

MITRE ATT&CK ids this rule names

• T1195.002
• T1557

References

• https://notepad-plus-plus.org/news/v889-released/
• https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
• https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
• https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
• https://securelist.com/notepad-supply-chain-attack/118708/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_gup_susp_child_process.yml