Rule Info
Name
Uncommon File Created by Notepad++ Updater Gup.EXE
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Date
2026-02-03 00:00:00
Modified
None
Id
3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
Tags
attack.collection attack.credential-access attack.t1195.002 attack.initial-access attack.t1557
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Swachchhanda Shrawan Poudel
Merge PR #5854 from @swachchhanda000 - Add Notepad++ Infrastructure Abuse Rules
2026-02-04
Scan your endpoints, forensic images or collected files with our portable scanner THOR