Windows DNS Detection for Notepad++ gup.exe Queries to Uncommon Domains

Alerts when Notepad++ gup.exe generates DNS queries to domains outside the approved set.

FreeUnreviewedSigmamediumv1

windows-dns-detection-for-notepad-gup-exe-queries-to-uncommon-domains-2074e137

title: Windows DNS Detection for Notepad++ gup.exe Queries to Uncommon Domains
id: 884520d7-2852-4961-b1c6-f35d82c3fe6a
status: experimental
description: This rule flags DNS queries made by the Notepad++ updater executable (gup.exe) when the queried domain is not among the listed legitimate update-related domains. Unexpected domains can indicate updater abuse, supply-chain interference, or other suspicious network activity that merits investigation. It relies on Windows DNS query telemetry that includes the querying process image path and the queried domain name (QueryName).
references:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-02
modified: 2026-03-16
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1195.002
  - attack.initial-access
  - attack.t1557
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    Image|endswith: \gup.exe
  filter_main_notepad_legit_domain:
    QueryName: notepad-plus-plus.org
  filter_optional_sourceforge_legit_domain:
    QueryName|endswith: .sourceforge.net
  filter_optional_github_legit_domain:
    - QueryName|endswith: .githubusercontent.com
    - QueryName: github.com
  filter_optional_google_storage_legit_domain:
    QueryName|endswith: .googleapis.com
  filter_optional_uncommon_domains:
    QueryName|endswith:
      - .azurewebsites.net
      - block.opendns.com
      - gateway.zscalerthree.net
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.
  - Other legitimate query to official domains not listed in the filter, needing tuning.
level: medium
license: DRL-1.1
related:
  - id: 2074e137-1b73-4e2d-88ba-5a3407dbdce0
    type: derived

What it detects

This rule flags DNS queries made by the Notepad++ updater executable (gup.exe) when the queried domain is not among the listed legitimate update-related domains. Unexpected domains can indicate updater abuse, supply-chain interference, or other suspicious network activity that merits investigation. It relies on Windows DNS query telemetry that includes the querying process image path and the queried domain name (QueryName).

Known false positives

Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.
Other legitimate query to official domains not listed in the filter, needing tuning.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.