Hide Navigation Hide TOC

Suspicious Child Process of Notepad++ Updater - GUP.Exe (bb0e87ce-c89f-4857-84fa-095e4483e9cb)

Detects suspicious child process creation by the Notepad++ updater process (gup.exe). This could indicate potential exploitation of the updater component to deliver unwanted malware.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Compromise Software Supply Chain - T1195.002 (bd369cd9-abb8-41ce-b5bb-fff23ee86c00)	Attack Pattern	Suspicious Child Process of Notepad++ Updater - GUP.Exe (bb0e87ce-c89f-4857-84fa-095e4483e9cb)	Sigma-Rules	1
Adversary-in-the-Middle - T1557 (035bb001-ab69-4a0b-9f6c-2de8b09e1b9d)	Attack Pattern	Suspicious Child Process of Notepad++ Updater - GUP.Exe (bb0e87ce-c89f-4857-84fa-095e4483e9cb)	Sigma-Rules	1
Compromise Software Supply Chain - T1195.002 (bd369cd9-abb8-41ce-b5bb-fff23ee86c00)	Attack Pattern	Supply Chain Compromise - T1195 (3f18edba-28f4-4bb9-82c3-8aa60dcac5f7)	Attack Pattern	2