Windows Process: Notepad++ GUP (GUP.exe) Download Execution via -unzipTo and URL
Detects Notepad++ GUP.exe downloading over HTTP initiated by a non-Notepad++ parent process.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-10
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where gup.exe (Notepad++ GUP utility) is launched and its command line includes both the -unzipTo argument and a URL containing http. It matters because gup is commonly used to retrieve content, and attackers may leverage legitimate tooling to download payloads or staging files. The detection relies on process creation telemetry, including Image/OriginalFileName and CommandLine fields, and it excludes cases where the parent process is notepad++.exe.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process: Notepad++ GUP (GUP.exe) Download Execution via -unzipTo and URL"
id: 5437f8bf-1e05-48da-9845-afac1fb5a1bb
status: test
description: This rule flags Windows process creation events where gup.exe (Notepad++ GUP utility) is launched and its command line includes both the -unzipTo argument and a URL containing http. It matters because gup is commonly used to retrieve content, and attackers may leverage legitimate tooling to download payloads or staging files. The detection relies on process creation telemetry, including Image/OriginalFileName and CommandLine fields, and it excludes cases where the parent process is notepad++.exe.
references:
- https://twitter.com/nas_bench/status/1535322182863179776
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gup_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2023-03-02
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \GUP.exe
- OriginalFileName: gup.exe
selection_cli:
CommandLine|contains|all:
- " -unzipTo "
- http
filter:
ParentImage|endswith: \notepad++.exe
condition: all of selection* and not filter
falsepositives:
- Other parent processes other than notepad++ using GUP that are not currently identified
level: high
license: DRL-1.1
related:
- id: 44143844-0631-49ab-97a0-96387d6b2d7c
type: derived