Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule flags DNS queries made by Notepad++ updater process gup.exe when the queried domain is not among a set of known legitimate update and hosting domains. Unusual DNS resolution can indicate abuse or diversion of the updater’s network behavior for malicious activity. It relies on Windows DNS query telemetry containing the querying process image ending with gup.exe and the DNS QueryName values.

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange

Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Suspicious Child Process Spawned by Python Interpreter via Process Creation

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

Suspicious TrueConf Update Chain Spawning Temporary Executable in Operation TrueChaos

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

Suspicious Sneaky 2FA Phishing Kit License Check via API Key Endpoint (via proxy)

Malicious PowerShell Download from bullethost.cloud Staging Server

Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

Pivot detection · T1195.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-detection-for-notepad-gup-exe-queries-to-uncommon-domains-2074e137

title: "Windows DNS Monitoring: gup.exe Queries to Uncommon Domains"
id: 884520d7-2852-4961-b1c6-f35d82c3fe6a
status: experimental
description: This rule flags DNS queries made by Notepad++ updater process gup.exe when the queried domain is not among a set of known legitimate update and hosting domains. Unusual DNS resolution can indicate abuse or diversion of the updater’s network behavior for malicious activity. It relies on Windows DNS query telemetry containing the querying process image ending with gup.exe and the DNS QueryName values.
references:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-02
modified: 2026-03-16
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1195.002
  - attack.initial-access
  - attack.t1557
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    Image|endswith: \gup.exe
  filter_main_notepad_legit_domain:
    QueryName: notepad-plus-plus.org
  filter_optional_sourceforge_legit_domain:
    QueryName|endswith: .sourceforge.net
  filter_optional_github_legit_domain:
    - QueryName|endswith: .githubusercontent.com
    - QueryName: github.com
  filter_optional_google_storage_legit_domain:
    QueryName|endswith: .googleapis.com
  filter_optional_uncommon_domains:
    QueryName|endswith:
      - .azurewebsites.net
      - block.opendns.com
      - gateway.zscalerthree.net
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.
  - Other legitimate query to official domains not listed in the filter, needing tuning.
level: medium
license: DRL-1.1
related:
  - id: 2074e137-1b73-4e2d-88ba-5a3407dbdce0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL