Windows: GUP Utility Used by Notepad++ Updater to Execute Arbitrary Binaries

Flags Notepad++ updater-launched GUP activity that causes explorer.exe to execute with notepad++ in the command line.

FreeUnreviewedSigmamediumv1

windows-gup-utility-used-by-notepad-updater-to-execute-arbitrary-binaries-d65aee4d

title: "Windows: GUP Utility Used by Notepad++ Updater to Execute Arbitrary Binaries"
id: b70e75ac-e294-4f73-bea1-792ae7b989e9
status: test
description: This rule identifies process creation where the GUP utility (gup.exe) is invoked by explorer.exe and notepad++ (notepad++.exe) is referenced in the command line, with the GUP parent coming from the Notepad++ updater directory. Attackers can use trusted updaters or helper utilities like GUP to launch additional commands or executables under a legitimate process chain. Detection relies on Windows process creation telemetry, specifically parent/child image paths and command-line content checks.
references:
  - https://twitter.com/nas_bench/status/1535322445439180803
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gup_arbitrary_binary_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2023-03-02
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \gup.exe
    Image|endswith: \explorer.exe
  filter:
    Image|endswith: \explorer.exe
    CommandLine|contains: \Notepad++\notepad++.exe
  filter_parent:
    ParentImage|contains: \Notepad++\updater\
  filter_null:
    CommandLine: null
  condition: selection and not 1 of filter*
falsepositives:
  - Other parent binaries using GUP not currently identified
level: medium
license: DRL-1.1
related:
  - id: d65aee4d-2292-4cea-b832-83accd6cfa43
    type: derived

What it detects

This rule identifies process creation where the GUP utility (gup.exe) is invoked by explorer.exe and notepad++ (notepad++.exe) is referenced in the command line, with the GUP parent coming from the Notepad++ updater directory. Attackers can use trusted updaters or helper utilities like GUP to launch additional commands or executables under a legitimate process chain. Detection relies on Windows process creation telemetry, specifically parent/child image paths and command-line content checks.

Known false positives

Other parent binaries using GUP not currently identified

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.