Notepadplusplus Supply Chain Updater Spawn
Detects the Notepad++ updater (GUP.exe) spawning child processes with suspicious names (update.exe, install.exe, AutoUpdater.exe) from the Local Temp directory. This behavior was a primary vector for all three execution chains identified in the Notepad++ supply chain attack.
YARA-L
