Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where the Notepad++ updater binary (gup.exe) writes to locations that are not typical for standard installation or expected update artifacts. Uncommon target paths can indicate abuse of the updater component to drop unwanted files or stage additional payloads. The detection relies on Windows file event telemetry that includes the creating process image name and the created file path (TargetFilename).

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange

Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

Suspicious Child Process Spawned by Python Interpreter via Process Creation

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

Suspicious TrueConf Update Chain Spawning Temporary Executable in Operation TrueChaos

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

Suspicious Sneaky 2FA Phishing Kit License Check via API Key Endpoint (via proxy)

Malicious PowerShell Download from bullethost.cloud Staging Server

Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Pivot detection · T1195.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-notepad-updater-gup-exe-creates-files-in-uncommon-locations-3b8f4c92

title: Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations
id: 59223e20-2db9-453f-b6f4-ecf48f604d5b
status: experimental
description: This rule flags file creation events where the Notepad++ updater binary (gup.exe) writes to locations that are not typical for standard installation or expected update artifacts. Uncommon target paths can indicate abuse of the updater component to drop unwanted files or stage additional payloads. The detection relies on Windows file event telemetry that includes the creating process image name and the created file path (TargetFilename).
references:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-03
modified: 2026-03-16
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1195.002
  - attack.initial-access
  - attack.t1557
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \gup.exe
  filter_main_legit_paths:
    TargetFilename|startswith:
      - C:\Program Files\Notepad++\
      - C:\Program Files (x86)\Notepad++\
  filter_main_temp_update_installer:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - npp.
      - .Installer.
      - .exe
  filter_main_temp_generic_zip:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - .zip
  filter_main_recycle_bin:
    TargetFilename|startswith: C:\$Recycle.Bin\S-1-5-21
  filter_main_plugins:
    - TargetFilename|contains:
        - \plugins\JsonTools\testfiles\
        - \Notepad++\plugins\ComparePlugin\
    - TargetFilename|contains|all:
        - npp.
        - .portable.
        - \plugins\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Custom or portable Notepad++ installations in non-standard directories.
  - Legitimate update processes creating temporary files in unexpected locations.
level: high
license: DRL-1.1
related:
  - id: 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL