Suspicious Arbitrary Binary Execution Via GUP Utility (via process_creation)

title: Suspicious Arbitrary Binary Execution Via GUP Utility (via process_creation)
id: 84f3ac3b-bc1b-521b-9750-84b7609a50cf
status: stable
description: This rule detects execution of the Notepad++ updater (gup) to launch other commands or executables
references:
    - https://twitter.com/nas_bench/status/1535322445439180803
author: Huntrule Team
date: 2026-03-12
tags:
    - attack.execution
    - attack.defense-evasion
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\gup.exe'
        Image|endswith: '\explorer.exe'
    filter:
        Image|endswith: '\explorer.exe'
        CommandLine|contains: '\Notepad++\notepad++.exe'
    filter_parent:
        ParentImage|contains: '\Notepad++\updater\'
    filter_null:
        CommandLine:
    condition: selection and not 1 of filter*
falsepositives:
    - Unknown
level: medium