Notepad++ GUP Spawning Update.exe
Detects the Notepad++ updater process (GUP.exe) spawning a child process named 'update.exe'. This behavior was observed during the Lotus Blossom supply chain attack where the Notepad++ update infrastructure was compromised to deliver the Chrysalis backdoor.
Microsoft Sentinel (KQL)
