Suspicious GUP.exe Usage Outside Standard Paths

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•3•0•53

This rule detects the execution of 'GUP.exe' (Notepad++ updater) from any directory other than its legitimate installation paths within 'Program Files' or user-specific 'AppData' folders. This behavior is often indicative of DLL side-loading attacks where a malicious GUP.exe might be placed in a controlled directory to load a malicious DLL.