Suspicious GUP Usage

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Known false positives

Execution of tools named GUP.exe and located in folders different than Notepad++\updater

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1574.001` Hijack Execution Flow: DLL
Stealth	`T1574.001` Hijack Execution Flow: DLL

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Suspicious GUP Usage
id: 0a4f6091-223b-41f6-8743-f322ec84930b
status: test
description: Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks
references:
    - https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html
author: Florian Roth (Nextron Systems)
date: 2019-02-06
modified: 2022-08-13
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\GUP.exe'
    filter_programfiles:
        Image|endswith:
            - '\Program Files\Notepad++\updater\GUP.exe'
            - '\Program Files (x86)\Notepad++\updater\GUP.exe'
    filter_user:
        Image|contains: '\Users\'
        Image|endswith:
            - '\AppData\Local\Notepad++\updater\GUP.exe'
            - '\AppData\Roaming\Notepad++\updater\GUP.exe'
    condition: selection and not 1 of filter_*
falsepositives:
    - Execution of tools named GUP.exe and located in folders different than Notepad++\updater
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_*

Stage 1: `selection`

selection:
    Image|endswith: '\GUP.exe'

Stage 2: `not filter_*`

filter_programfiles:
    Image|endswith:
        - '\Program Files\Notepad++\updater\GUP.exe'
        - '\Program Files (x86)\Notepad++\updater\GUP.exe'
filter_user:
    Image|contains: '\Users\'
    Image|endswith:
        - '\AppData\Local\Notepad++\updater\GUP.exe'
        - '\AppData\Roaming\Notepad++\updater\GUP.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`\AppData\Local\Notepad++\updater\GUP.exe`	`excludes:Image` `field:"Image" value:"\AppData\Local\Notepad++\updater\GUP.exe"`
`Image`	ends_with	`\AppData\Roaming\Notepad++\updater\GUP.exe`	`excludes:Image` `field:"Image" value:"\AppData\Roaming\Notepad++\updater\GUP.exe"`
`Image`	match	`\Users\`	`excludes:Image` `field:"Image" value:"\Users\"`
`Image`	ends_with	`\Program Files (x86)\Notepad++\updater\GUP.exe`	`excludes:Image` `field:"Image" value:"\Program Files (x86)\Notepad++\updater\GUP.exe"`
`Image`	ends_with	`\Program Files\Notepad++\updater\GUP.exe`	`excludes:Image` `field:"Image" value:"\Program Files\Notepad++\updater\GUP.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\GUP.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\GUP.exe"`