huntrule

Windows: Notepad++ GUP (GUP.exe) File Downloads via HTTP When Parent Is Not notepad++.exe

Detects Notepad++ GUP.exe downloading over HTTP initiated by a non-Notepad++ parent process.

FreeUnreviewedSigmahighv1
title: "Windows: Notepad++ GUP (GUP.exe) File Downloads via HTTP When Parent Is Not notepad++.exe"
id: 5437f8bf-1e05-48da-9845-afac1fb5a1bb
status: test
description: This rule flags execution of the Notepad++ GUP downloader (GUP.exe) when it is started by a parent process other than Notepad++ (notepad++.exe). It specifically looks for command-line usage that includes both a “-unzipTo” argument and an HTTP URL, consistent with fetching and preparing downloaded content. The detection relies on Windows process creation telemetry, including Image, OriginalFileName, CommandLine, and ParentImage path information.
references:
  - https://twitter.com/nas_bench/status/1535322182863179776
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gup_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2023-03-02
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \GUP.exe
    - OriginalFileName: gup.exe
  selection_cli:
    CommandLine|contains|all:
      - " -unzipTo "
      - http
  filter:
    ParentImage|endswith: \notepad++.exe
  condition: all of selection* and not filter
falsepositives:
  - Other parent processes other than notepad++ using GUP that are not currently identified
level: high
license: DRL-1.1
related:
  - id: 44143844-0631-49ab-97a0-96387d6b2d7c
    type: derived

What it detects

This rule flags execution of the Notepad++ GUP downloader (GUP.exe) when it is started by a parent process other than Notepad++ (notepad++.exe). It specifically looks for command-line usage that includes both a “-unzipTo” argument and an HTTP URL, consistent with fetching and preparing downloaded content. The detection relies on Windows process creation telemetry, including Image, OriginalFileName, CommandLine, and ParentImage path information.

Known false positives

  • Other parent processes other than notepad++ using GUP that are not currently identified

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.