Suspicious Notepad++ Updater Child Process
Detects the legitimate Notepad++ updater (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was abused to download and execute malicious installers and command interpreters.
Sigma
