Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Alerts when Notepad++ gup.exe spawns command/scripting or utility processes using suspicious tool keywords on Windows.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-02-03
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Collection

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the Notepad++ updater binary (gup.exe) spawns a suspicious child process. It focuses on child images commonly used for command execution and script handling (cmd.exe, powershell.exe/pwsh, cscript/wscript, mshta.exe) and CLI patterns associated with common download or execution tooling (bitsadmin, certutil, curl, wget, regsvr32, rundll32, forfiles, etc.). This matters because abused updaters can use spawned processes to execute or stage unwanted payloads; the detection relies on process creation telemetry including parent image, child image, and command line.

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange

Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

Suspicious Tycoon 2FA Phishing Script Retrieval

Malicious Shai-Hulud Self-Hosted GitHub Runner Registration via Process Creation

Suspicious Google Workspace OAuth Authorization for Chrome Web Store Scope via Token Audit

Malicious Shai-Hulud npm Worm Marker via SHA1HULUD Process Name (via process_creation)

Suspicious Firefox Enterprise Root Certificate Trust Enabled

Malicious Shai-Hulud Self-Hosted GitHub Actions Runner Named SHA1HULUD (via process_creation)

Malicious Root Certificate Installed via certutil addstore for AiTM Interception

Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Pivot detection · T1195.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-child-process-execution-by-notepad-updater-gup-exe-bb0e87ce

title: "Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)"
id: 1a4c3e70-1155-4cb6-ad94-baf554d10dcd
status: experimental
description: This rule flags Windows process creation events where the Notepad++ updater binary (gup.exe) spawns a suspicious child process. It focuses on child images commonly used for command execution and script handling (cmd.exe, powershell.exe/pwsh, cscript/wscript, mshta.exe) and CLI patterns associated with common download or execution tooling (bitsadmin, certutil, curl, wget, regsvr32, rundll32, forfiles, etc.). This matters because abused updaters can use spawned processes to execute or stage unwanted payloads; the detection relies on process creation telemetry including parent image, child image, and command line.
references:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gup_susp_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-02-03
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1195.002
  - attack.initial-access
  - attack.t1557
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \gup.exe
  selection_child_img:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \cscript.exe
      - \wscript.exe
      - \mshta.exe
  selection_child_cli:
    CommandLine|contains:
      - bitsadmin
      - certutil
      - curl
      - finger
      - forfiles
      - regsvr32
      - rundll32
      - wget
  condition: selection_parent and 1 of selection_child_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: bb0e87ce-c89f-4857-84fa-095e4483e9cb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL