Notepad++ Updater Spawning Suspicious Child Process

Ethan Andrews@eandrews

•updated Feb 3, 2026•12•0•66

Detects the legitimate Notepad++ updater process (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was used to launch malicious payloads. The rule specifically looks for GUP.exe as the parent process and child processes with filenames like 'update.exe', 'install.exe', 'AutoUpdater.exe', 'curl.exe', or 'cmd.exe'.