Notepad++ Updater DNS Query to Unusual Domains (via dns_query)

title: Notepad++ Updater DNS Query to Unusual Domains (via dns_query)
id: 6923f465-0378-519b-b23f-c49b78b4055d
status: stable
description: This rule detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or anomalous network behavior that warrants further investigation.
references:
    - https://attack.mitre.org/techniques/T1557/
    - https://attack.mitre.org/techniques/T1195/002/
    - https://notepad-plus-plus.org/news/v889-released/
    - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
    - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
    - https://securelist.com/notepad-supply-chain-attack/118708/
author: Huntrule Team
date: 2026-04-24
tags:
    - attack.collection
    - attack.credential-access
    - attack.t1195.002
    - attack.initial-access
    - attack.t1557
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        Image|endswith: '\gup.exe'
    filter_main_notepad_legit_domain:
        QueryName: 'notepad-plus-plus.org'
    filter_optional_sourceforge_legit_domain:
        QueryName|endswith: '.sourceforge.net'
    filter_optional_github_legit_domain:
        - QueryName|endswith: '.githubusercontent.com'
        - QueryName: 'github.com'
    filter_optional_google_storage_legit_domain:
        QueryName|endswith: '.googleapis.com'
    filter_optional_uncommon_domains:
        QueryName|endswith:
            - '.azurewebsites.net'
            - 'block.opendns.com'
            - 'gateway.zscalerthree.net'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium