File Download Using Notepad++ GUP Utility
This rule detects when the Notepad++ updater utility (GUP.exe) is executed by a process other than Notepad++ itself, specifically when command-line arguments indicate a file download operation (containing '-unzipTo' and 'http'). This behavior can be indicative of an adversary abusing a legitimate application's updater for ingress tool transfer or other malicious file downloads, bypassing typical security controls that might monitor direct download utilities.
Sigma
