Windows DNS Monitoring: gup.exe Queries to Uncommon Domains
Alerts when Notepad++ gup.exe generates DNS queries to domains outside the approved set.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- dns_query
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-02-02
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags DNS queries made by Notepad++ updater process gup.exe when the queried domain is not among a set of known legitimate update and hosting domains. Unusual DNS resolution can indicate abuse or diversion of the updater’s network behavior for malicious activity. It relies on Windows DNS query telemetry containing the querying process image ending with gup.exe and the DNS QueryName values.
Reporting behind it
- notepad-plus-plus.orghttps://notepad-plus-plus.org/news/v889-released/
- heise.dehttps://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
- rapid7.comhttps://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
- validin.comhttps://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
- securelist.comhttps://securelist.com/notepad-supply-chain-attack/118708/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-dns-detection-for-notepad-gup-exe-queries-to-uncommon-domains-2074e137
title: "Windows DNS Monitoring: gup.exe Queries to Uncommon Domains"
id: 884520d7-2852-4961-b1c6-f35d82c3fe6a
status: experimental
description: This rule flags DNS queries made by Notepad++ updater process gup.exe when the queried domain is not among a set of known legitimate update and hosting domains. Unusual DNS resolution can indicate abuse or diversion of the updater’s network behavior for malicious activity. It relies on Windows DNS query telemetry containing the querying process image ending with gup.exe and the DNS QueryName values.
references:
- https://notepad-plus-plus.org/news/v889-released/
- https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
- https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
- https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
- https://securelist.com/notepad-supply-chain-attack/118708/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-02
modified: 2026-03-16
tags:
- attack.collection
- attack.credential-access
- attack.t1195.002
- attack.initial-access
- attack.t1557
logsource:
category: dns_query
product: windows
detection:
selection:
Image|endswith: \gup.exe
filter_main_notepad_legit_domain:
QueryName: notepad-plus-plus.org
filter_optional_sourceforge_legit_domain:
QueryName|endswith: .sourceforge.net
filter_optional_github_legit_domain:
- QueryName|endswith: .githubusercontent.com
- QueryName: github.com
filter_optional_google_storage_legit_domain:
QueryName|endswith: .googleapis.com
filter_optional_uncommon_domains:
QueryName|endswith:
- .azurewebsites.net
- block.opendns.com
- gateway.zscalerthree.net
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.
- Other legitimate query to official domains not listed in the filter, needing tuning.
level: medium
license: DRL-1.1
related:
- id: 2074e137-1b73-4e2d-88ba-5a3407dbdce0
type: derived