Rogue Notepad++ Update Binary Execution
Detects the execution of suspicious binaries (update.exe, AutoUpdater.exe) from a temporary directory, where the parent process is the Notepad++ updater (gup.exe). Notepad++ does not use these filenames for legitimate updates, and this behavior is indicative of a hijacked update process.
Sigma
