Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Alerts on file creations by Notepad++ updater gup.exe when the destination path is uncommon or not in allowed locations.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-02-03
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where the Notepad++ updater binary (gup.exe) writes to locations that are not typical for standard installation or expected update artifacts. Uncommon target paths can indicate abuse of the updater component to drop unwanted files or stage additional payloads. The detection relies on Windows file event telemetry that includes the creating process image name and the created file path (TargetFilename).

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange

Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

Suspicious Tycoon 2FA Phishing Script Retrieval

Malicious Shai-Hulud Self-Hosted GitHub Runner Registration via Process Creation

Suspicious Google Workspace OAuth Authorization for Chrome Web Store Scope via Token Audit

Malicious Shai-Hulud npm Worm Marker via SHA1HULUD Process Name (via process_creation)

Suspicious Firefox Enterprise Root Certificate Trust Enabled

Malicious Shai-Hulud Self-Hosted GitHub Actions Runner Named SHA1HULUD (via process_creation)

Malicious Root Certificate Installed via certutil addstore for AiTM Interception

Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Pivot detection · T1195.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-notepad-updater-gup-exe-creates-files-in-uncommon-locations-3b8f4c92

title: Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations
id: 59223e20-2db9-453f-b6f4-ecf48f604d5b
status: experimental
description: This rule flags file creation events where the Notepad++ updater binary (gup.exe) writes to locations that are not typical for standard installation or expected update artifacts. Uncommon target paths can indicate abuse of the updater component to drop unwanted files or stage additional payloads. The detection relies on Windows file event telemetry that includes the creating process image name and the created file path (TargetFilename).
references:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-03
modified: 2026-03-16
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1195.002
  - attack.initial-access
  - attack.t1557
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \gup.exe
  filter_main_legit_paths:
    TargetFilename|startswith:
      - C:\Program Files\Notepad++\
      - C:\Program Files (x86)\Notepad++\
  filter_main_temp_update_installer:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - npp.
      - .Installer.
      - .exe
  filter_main_temp_generic_zip:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - .zip
  filter_main_recycle_bin:
    TargetFilename|startswith: C:\$Recycle.Bin\S-1-5-21
  filter_main_plugins:
    - TargetFilename|contains:
        - \plugins\JsonTools\testfiles\
        - \Notepad++\plugins\ComparePlugin\
    - TargetFilename|contains|all:
        - npp.
        - .portable.
        - \plugins\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Custom or portable Notepad++ installations in non-standard directories.
  - Legitimate update processes creating temporary files in unexpected locations.
level: high
license: DRL-1.1
related:
  - id: 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL