#event_simpleName=ProcessRollup2 event_platform=Win ParentBaseFileName="gup.exe"
| FilePath=/\\Device\\HarddiskVolume\d+(?<shortFilePath>.+$)/
| groupBy([FileName, SHA256HashData, shortFilePath, CommandLine])

#event_simpleName=/(ProcessRollup2|NetworkConnectIP4|DnsRequest)/ event_platform=Win
| case {
    // Malicious IPs
    RemoteAddressIP4=/(95\.179\.213\.0|61\.4\.102\.97|59\.110\.7\.32|124\.222\.137\.114|45\.76\.155\.202|45\.32\.144\.255|45\.77\.31\.210)/
        | iocType := "Malicious IP" | iocValue := RemoteAddressIP4 | riskScore := "HIGH";
    // Malicious Domains
    DomainName=/(api\.skycloudcenter\.com|api\.wiresguard\.com|cdncheck\.it\.com|safe-dns\.it\.com|self-dns\.it\.com|temp\.sh)/i
        | iocType := "Malicious Domain" | iocValue := DomainName | riskScore := "HIGH";
    // Suspicious filenames
    ImageFileName=/\\(BluetoothService|admin|system|loader1|loader2|s047t5g|ConsoleApplication2|3yzr31vk|uffhxpSy)\.exe$/i
        | iocType := "Suspicious Filename" | iocValue := ImageFileName | riskScore := "MEDIUM";
    // Suspicious DLLs
    ImageFileName=/\\(log\.dll|libtcc\.dll)$/i
        | iocType := "Suspicious DLL" | iocValue := ImageFileName | riskScore := "MEDIUM";
    // Chain-specific artifacts
    ImageFileName=/\\(alien\.ini|load)$/i
        | iocType := "Chain Artifact" | iocValue := ImageFileName | riskScore := "HIGH";
    * | iocType := null;
}
| iocType=*
| ImageFileName=/\\(?<FileName>[^\\]+)$/
| table([riskScore, iocType, iocValue, @timestamp, aid, ComputerName, FileName, ImageFileName, CommandLine, SHA256HashData, RemoteAddressIP4, DomainName], limit=5000)

#event_simpleName=DirectoryCreate event_platform=Win
| FilePath=/\\ns\.tmp$/i
| FilePath=/\\Temp\\ns\.tmp$/i
| groupBy([aid, ComputerName, FilePath, ContextTimeStamp], limit=5000)

rule Notepadpp_SupplyChain_MaliciousUpdater {
    meta:
        description = "Detects malicious NSIS installers from Notepad++ supply chain attack"
        author = "Renato Z3r0 ed i miei sorcini"
        date = "2026-02"
        reference = "https://securelist.com/notepad-supply-chain-attack/118708/"
        tlp = "WHITE"
        
    strings:
        $nsis = "Nullsoft.NSIS" ascii
        $recon1 = "whoami" ascii nocase
        $recon2 = "tasklist" ascii nocase
        $recon3 = "systeminfo" ascii nocase
        $recon4 = "netstat -ano" ascii nocase
        $exfil = "temp.sh/upload" ascii nocase
        $curl = "curl" ascii nocase
        $dir1 = "\\ProShow\\" ascii nocase
        $dir2 = "\\Adobe\\Scripts\\" ascii nocase
        $dir3 = "\\Bluetooth\\" ascii nocase
        
    condition:
        uint16(0) == 0x5A4D and
        $nsis and
        (2 of ($recon*) or $exfil or ($curl and 1 of ($recon*))) and
        1 of ($dir*)
}

title: Notepad++ GUP.exe Suspicious Child Process
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects GUP.exe (Notepad++ updater) spawning suspicious child processes indicative of supply chain compromise
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
tags:
    - attack.initial_access
    - attack.t1195.002
    - cve.2025.15556
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\gup.exe'
    filter_legitimate:
        Image|endswith:
            - '\npp.Installer.x64.exe'
            - '\npp.Installer.exe'
    condition: selection_parent and not filter_legitimate
falsepositives:
    - Legitimate Notepad++ installers with non-standard naming
level: high

title: Reconnaissance Data Exfiltration via temp.sh
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects system reconnaissance followed by data upload to temp.sh, as observed in Notepad++ supply chain attack
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
tags:
    - attack.exfiltration
    - attack.t1567
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_curl:
        CommandLine|contains:
            - 'temp.sh/upload'
            - 'temp.sh'
        Image|endswith: '\curl.exe'
    condition: selection_curl
falsepositives:
    - Legitimate use of temp.sh file sharing service (rare in corporate environments)
level: high

title: Notepad++ Supply Chain C2 Domain Resolution
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects DNS resolution of C2 domains associated with the Notepad++ supply chain attack
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'cdncheck.it.com'
            - 'safe-dns.it.com'
            - 'self-dns.it.com'
            - 'api.skycloudcenter.com'
            - 'api.wiresguard.com'
    condition: selection
falsepositives:
    - Very unlikely in corporate environments
level: critical