File Download Using Notepad++ GUP Utility
This rule detects the execution of the Notepad++ updater utility (GUP.exe) when it is launched by a process other than Notepad++ itself, and is used to download files from the internet. Specifically, it looks for GUP.exe being executed with command-line arguments indicating an unzip operation ('-unzipto') and a URL ('http'), while ensuring the parent process is not Notepad++. This behavior can indicate an adversary abusing a legitimate utility for ingress tool transfer.
YARA-L
