Detect Notepad++ LOLC2

Daniel Jeremiah@daniyyell

•updated Feb 22, 2026•0•56

This rule detects a multi-stage attack chain. The first rule identifies the Notepad++ updater (GUP.exe) spawning curl.exe to upload reconnaissance output to 'temp.sh/upload', indicating a potential supply-chain attack. The second rule detects the execution of 'ProShow.exe' from an unusual location within the AppData\Roaming\ProShow directory, which is part of a described execution chain. The third rule identifies the execution of 'script.exe' with 'alien.ini' from the AppData\Roaming\Adobe\Scripts directory, matching another stage of the supply-chain attack.