Notepad++ Updater Connecting to Unusual Domains
Detects the Notepad++ updater process (gup.exe) making network connections to domains other than the official Notepad++ or GitHub domains. This could indicate a compromised update process or a supply chain attack where the updater is redirected to a malicious download location.
Microsoft Sentinel (KQL)
