Notepad++ supply chain attack

Aamir Muhammad@Aamir

•updated Mar 25, 2026•4•0•105

This rule detects a combination of suspicious activities indicative of multi-stage malicious operations. It identifies GUP.exe beaconing to command and control (C2) servers, execution of known malicious hashes (SHA256 and SHA1), connections to C2 IP addresses and domains, suspicious filenames, DLL side-loading attempts, suspicious script/code execution, data exfiltration via curl, reconnaissance commands (whoami, tasklist, systeminfo, netstat), secondary payload writes, and initial malicious execution originating from gup.exe or temporary directories.