Windows process execution of GUP.exe outside Notepad++ updater paths

title: Windows process execution of GUP.exe outside Notepad++ updater paths
id: 13f78edb-ac69-44a5-b13b-9dad1999cd11
status: test
description: This rule flags process creation events where the executable name ends with GUP.exe but the full path does not match the expected Notepad++ updater directories in Program Files or user AppData locations. Attackers may use similarly named binaries placed in alternate directories to facilitate side-loading, persistence, or stealthy execution. It relies on Windows process creation telemetry, matching the image path suffix and excluding known legitimate updater locations.
references:
  - https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gup_suspicious_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-02-06
modified: 2022-08-13
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \GUP.exe
  filter_programfiles:
    Image|endswith:
      - \Program Files\Notepad++\updater\GUP.exe
      - \Program Files (x86)\Notepad++\updater\GUP.exe
  filter_user:
    Image|contains: \Users\
    Image|endswith:
      - \AppData\Local\Notepad++\updater\GUP.exe
      - \AppData\Roaming\Notepad++\updater\GUP.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Execution of tools named GUP.exe and located in folders different than Notepad++\updater
level: high
license: DRL-1.1
related:
  - id: 0a4f6091-223b-41f6-8743-f322ec84930b
    type: derived