Windows: Notepad++ Updater gup.exe Creates Files in Uncommon Locations

title: "Windows: Notepad++ Updater gup.exe Creates Files in Uncommon Locations"
id: 59223e20-2db9-453f-b6f4-ecf48f604d5b
status: experimental
description: This rule flags file creation events where the Notepad++ updater executable (gup.exe) writes to target paths that are not typical installation directories or other predefined benign locations. Attackers may abuse updater components to drop payloads, installers, or auxiliary files into locations that are less expected for normal updates. The detection relies on Windows file event telemetry that includes the creating process image name and the full target filename/path of the created file.
references:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-03
modified: 2026-03-16
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1195.002
  - attack.initial-access
  - attack.t1557
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \gup.exe
  filter_main_legit_paths:
    TargetFilename|startswith:
      - C:\Program Files\Notepad++\
      - C:\Program Files (x86)\Notepad++\
  filter_main_temp_update_installer:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - npp.
      - .Installer.
      - .exe
  filter_main_temp_generic_zip:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - .zip
  filter_main_recycle_bin:
    TargetFilename|startswith: C:\$Recycle.Bin\S-1-5-21
  filter_main_plugins:
    - TargetFilename|contains:
        - \plugins\JsonTools\testfiles\
        - \Notepad++\plugins\ComparePlugin\
    - TargetFilename|contains|all:
        - npp.
        - .portable.
        - \plugins\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Custom or portable Notepad++ installations in non-standard directories.
  - Legitimate update processes creating temporary files in unexpected locations.
level: high
license: DRL-1.1
related:
  - id: 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
    type: derived