Chrysalis Backdoor: Notepad++ Updater Spawning Reconnaissance Commands
This rule detects a highly suspicious activity where the Notepad++ updater process (GUP.exe) spawns the Windows Command Shell (cmd.exe) to execute various reconnaissance commands. This behavior is specifically linked to the Chrysalis backdoor, which was involved in a supply chain attack targeting Notepad++. The presence of commands like 'whoami', 'tasklist', 'systeminfo', 'ipconfig', and 'net' (with user, view, or group arguments) indicates an adversary attempting to gather information about the compromised system and network.
YARA-L
