Windows: GUP Utility Spawns Commands from Explorer via Notepad++ Updater
Flags Notepad++ updater-launched GUP activity that causes explorer.exe to execute with notepad++ in the command line.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-10
- Updated
- 2026-07-31
What it detects
This rule identifies suspicious process creation where gup.exe is launched by explorer.exe while related to the Notepad++ updater path. Attackers can abuse this updater utility to execute arbitrary commands or binaries under a trusted parent process. Detection relies on Windows process creation telemetry, matching the parent and image filenames and constraining the Notepad++ executable context in the command line while excluding benign matches.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-gup-utility-used-by-notepad-updater-to-execute-arbitrary-binaries-d65aee4d
title: "Windows: GUP Utility Spawns Commands from Explorer via Notepad++ Updater"
id: b70e75ac-e294-4f73-bea1-792ae7b989e9
status: test
description: This rule identifies suspicious process creation where gup.exe is launched by explorer.exe while related to the Notepad++ updater path. Attackers can abuse this updater utility to execute arbitrary commands or binaries under a trusted parent process. Detection relies on Windows process creation telemetry, matching the parent and image filenames and constraining the Notepad++ executable context in the command line while excluding benign matches.
references:
- https://twitter.com/nas_bench/status/1535322445439180803
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gup_arbitrary_binary_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2023-03-02
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \gup.exe
Image|endswith: \explorer.exe
filter:
Image|endswith: \explorer.exe
CommandLine|contains: \Notepad++\notepad++.exe
filter_parent:
ParentImage|contains: \Notepad++\updater\
filter_null:
CommandLine: null
condition: selection and not 1 of filter*
falsepositives:
- Other parent binaries using GUP not currently identified
level: medium
license: DRL-1.1
related:
- id: d65aee4d-2292-4cea-b832-83accd6cfa43
type: derived