#event_simpleName=ProcessRollup2 event_platform=Win ParentBaseFileName="gup.exe"
| FilePath=/\\Device\\HarddiskVolume\d+(?<shortFilePath>.+$)/
| groupBy([FileName, SHA256HashData, shortFilePath, CommandLine])

#event_simpleName=/(ProcessRollup2|NetworkConnectIP4|DnsRequest)/ event_platform=Win
| case {
    // IP malveillantes
    RemoteAddressIP4=/(95\.179\.213\.0|61\.4\.102\.97|59\.110\.7\.32|124\.222\.137\.114|45\.76\.155\.202|45\.32\.144\.255|45\.77\.31\.210)/
        | iocType := "IP malveillante" | iocValue := RemoteAddressIP4 | riskScore := "HIGH";
    // Domaines malveillants
    DomainName=/(api\.skycloudcenter\.com|api\.wiresguard\.com|cdncheck\.it\.com|safe-dns\.it\.com|self-dns\.it\.com|temp\.sh)/i
        | iocType := "Domaine malveillant" | iocValue := DomainName | riskScore := "HIGH";
    // Noms de fichiers suspects
    ImageFileName=/\\(BluetoothService|admin|system|loader1|loader2|s047t5g|ConsoleApplication2|3yzr31vk|uffhxpSy)\.exe$/i
        | iocType := "Nom de fichier suspect" | iocValue := ImageFileName | riskScore := "MEDIUM";
    // DLL suspectes
    ImageFileName=/\\(log\.dll|libtcc\.dll)$/i
        | iocType := "DLL suspecte" | iocValue := ImageFileName | riskScore := "MEDIUM";
    // Artefacts spécifiques aux chaînes
    ImageFileName=/\\(alien\.ini|load)$/i
        | iocType := "Artefact de chaîne" | iocValue := ImageFileName | riskScore := "HIGH";
    * | iocType := null;
}
| iocType=*
| ImageFileName=/\\(?<FileName>[^\\]+)$/
| table([riskScore, iocType, iocValue, @timestamp, aid, ComputerName, FileName, ImageFileName, CommandLine, SHA256HashData, RemoteAddressIP4, DomainName], limit=5000)

#event_simpleName=DirectoryCreate event_platform=Win
| FilePath=/\\ns\.tmp$/i
| FilePath=/\\Temp\\ns\.tmp$/i
| groupBy([aid, ComputerName, FilePath, ContextTimeStamp], limit=5000)

rule Notepadpp_SupplyChain_MaliciousUpdater {
    meta:
        description = "Détecte les installateurs NSIS malveillants de l'attaque sur la chaîne d'approvisionnement de Notepad++"
        author = "Renato Z3r0 ed i miei sorcini"
        date = "2026-02"
        reference = "https://securelist.com/notepad-supply-chain-attack/118708/"
        tlp = "WHITE"
        
    strings:
        $nsis = "Nullsoft.NSIS" ascii
        $recon1 = "whoami" ascii nocase
        $recon2 = "tasklist" ascii nocase
        $recon3 = "systeminfo" ascii nocase
        $recon4 = "netstat -ano" ascii nocase
        $exfil = "temp.sh/upload" ascii nocase
        $curl = "curl" ascii nocase
        $dir1 = "\\ProShow\\" ascii nocase
        $dir2 = "\\Adobe\\Scripts\\" ascii nocase
        $dir3 = "\\Bluetooth\\" ascii nocase
        
    condition:
        uint16(0) == 0x5A4D and
        $nsis and
        (2 of ($recon*) or $exfil or ($curl and 1 of ($recon*))) and
        1 of ($dir*)
}

title: Notepad++ GUP.exe processus enfant suspect
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Détecte GUP.exe (programme de mise à jour de Notepad++) générant des processus enfants suspects indiquant une compromission de la chaîne d'approvisionnement
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
tags:
    - attack.initial_access
    - attack.t1195.002
    - cve.2025.15556
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\gup.exe'
    filter_legitimate:
        Image|endswith:
            - '\npp.Installer.x64.exe'
            - '\npp.Installer.exe'
    condition: selection_parent and not filter_legitimate
falsepositives:
    - Installateurs Notepad++ légitimes avec des noms non standard
level: high

title: Exfiltration de données de reconnaissance via temp.sh
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Détecte une reconnaissance système suivie d'un téléchargement de données vers temp.sh, comme observé dans l'attaque sur la chaîne d'approvisionnement de Notepad++
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
tags:
    - attack.exfiltration
    - attack.t1567
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_curl:
        CommandLine|contains:
            - 'temp.sh/upload'
            - 'temp.sh'
        Image|endswith: '\curl.exe'
    condition: selection_curl
falsepositives:
    - Utilisation légitime du service de partage de fichiers temp.sh (rare dans les environnements d'entreprise)
level: high

title: Résolution de domaine C2 de la chaîne d'approvisionnement Notepad++
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Détecte la résolution DNS de domaines C2 associés à l'attaque sur la chaîne d'approvisionnement de Notepad++
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'cdncheck.it.com'
            - 'safe-dns.it.com'
            - 'self-dns.it.com'
            - 'api.skycloudcenter.com'
            - 'api.wiresguard.com'
    condition: selection
falsepositives:
    - Très peu probable dans les environnements d'entreprise
level: critical