Suspicious Process Spawning from Notepad++ Updater

Daniel Miller@dxmiller

•updated Feb 2, 2026•20•1•117

This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.