Suspicious Notepad++ Updater Child Process
Detects the Notepad++ updater (gup.exe) spawning suspicious child processes such as shells or network tools. Legitimate updates should only spawn explorer.exe or the Notepad++ installer itself. This behavior has been observed in targeted attacks where the update process is hijacked to deliver malware and facilitate hands-on-keyboard activity.
Sigma
