Uncommon File Created by Notepad++ Updater Gup.EXE

Severity: high
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: upstream

Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1195.002` Supply Chain Compromise: Compromise Software Supply Chain
Credential Access	`T1557` Adversary-in-the-Middle
Collection	`T1557` Adversary-in-the-Middle

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `selection`

Image|endswith: '\gup.exe'

Stage 2: `not 1 of filter_main_*`

or:
TargetFilename|contains: .Installer.
TargetFilename|contains: .exe
TargetFilename|contains: '\AppData\Local\Temp\'
TargetFilename|contains: npp.
TargetFilename|startswith: 'C:\Users\'
TargetFilename|contains: .portable.
TargetFilename|contains: '\plugins\'
TargetFilename|contains: npp.
TargetFilename|contains: .zip
TargetFilename|contains: '\AppData\Local\Temp\'
TargetFilename|startswith: 'C:\Users\'
TargetFilename|contains: '\Notepad++\plugins\ComparePlugin\'
TargetFilename|contains: '\plugins\JsonTools\testfiles\'
TargetFilename|startswith: 'C:\$Recycle.Bin\S-1-5-21'
TargetFilename|startswith: 'C:\Program Files (x86)\Notepad++\'
TargetFilename|startswith: 'C:\Program Files\Notepad++\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\gup.exe` corpus 3 (sigma 3)
`TargetFilename`	match	`.Installer.` `.exe` corpus 3 (sigma 3) `.portable.` `.zip` `\AppData\Local\Temp\` corpus 11 (sigma 11) `\Notepad++\plugins\ComparePlugin\` `\plugins\` `\plugins\JsonTools\testfiles\` `npp.`
`TargetFilename`	starts_with	`C:\$Recycle.Bin\S-1-5-21` `C:\Program Files (x86)\Notepad++\` `C:\Program Files\Notepad++\` `C:\Users\` corpus 12 (sigma 12)