#event_simpleName=ProcessRollup2 event_platform=Win ParentBaseFileName="gup.exe"
| FilePath=/\\Device\\HarddiskVolume\d+(?<shortFilePath>.+$)/
| groupBy([FileName, SHA256HashData, shortFilePath, CommandLine])

#event_simpleName=/(ProcessRollup2|NetworkConnectIP4|DnsRequest)/ event_platform=Win
| case {
    // 악성 IP
    RemoteAddressIP4=/(95\.179\.213\.0|61\.4\.102\.97|59\.110\.7\.32|124\.222\.137\.114|45\.76\.155\.202|45\.32\.144\.255|45\.77\.31\.210)/
        | iocType := "악성 IP" | iocValue := RemoteAddressIP4 | riskScore := "높음";
    // 악성 도메인
    DomainName=/(api\.skycloudcenter\.com|api\.wiresguard\.com|cdncheck\.it\.com|safe-dns\.it\.com|self-dns\.it\.com|temp\.sh)/i
        | iocType := "악성 도메인" | iocValue := DomainName | riskScore := "높음";
    // 의심스러운 파일명
    ImageFileName=/\\(BluetoothService|admin|system|loader1|loader2|s047t5g|ConsoleApplication2|3yzr31vk|uffhxpSy)\.exe$/i
        | iocType := "의심스러운 파일명" | iocValue := ImageFileName | riskScore := "중간";
    // 의심스러운 DLL
    ImageFileName=/\\(log\.dll|libtcc\.dll)$/i
        | iocType := "의심스러운 DLL" | iocValue := ImageFileName | riskScore := "중간";
    // 체인별 아티팩트
    ImageFileName=/\\(alien\.ini|load)$/i
        | iocType := "체인 아티팩트" | iocValue := ImageFileName | riskScore := "높음";
    * | iocType := null;
}
| iocType=*
| ImageFileName=/\\(?<FileName>[^\\]+)$/
| table([riskScore, iocType, iocValue, @timestamp, aid, ComputerName, FileName, ImageFileName, CommandLine, SHA256HashData, RemoteAddressIP4, DomainName], limit=5000)

#event_simpleName=DirectoryCreate event_platform=Win
| FilePath=/\\ns\.tmp$/i
| FilePath=/\\Temp\\ns\.tmp$/i
| groupBy([aid, ComputerName, FilePath, ContextTimeStamp], limit=5000)

rule Notepadpp_SupplyChain_MaliciousUpdater {
    meta:
        description = "Notepad++ 공급망 공격에서 악성 NSIS 설치 프로그램 탐지"
        author = "Renato Z3r0 ed i miei sorcini"
        date = "2026-02"
        reference = "https://securelist.com/notepad-supply-chain-attack/118708/"
        tlp = "WHITE"
        
    strings:
        $nsis = "Nullsoft.NSIS" ascii
        $recon1 = "whoami" ascii nocase
        $recon2 = "tasklist" ascii nocase
        $recon3 = "systeminfo" ascii nocase
        $recon4 = "netstat -ano" ascii nocase
        $exfil = "temp.sh/upload" ascii nocase
        $curl = "curl" ascii nocase
        $dir1 = "\\ProShow\\" ascii nocase
        $dir2 = "\\Adobe\\Scripts\\" ascii nocase
        $dir3 = "\\Bluetooth\\" ascii nocase
        
    condition:
        uint16(0) == 0x5A4D and
        $nsis and
        (2 of ($recon*) or $exfil or ($curl and 1 of ($recon*))) and
        1 of ($dir*)
}

title: Notepad++ GUP.exe 의심스러운 자식 프로세스
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: GUP.exe(Notepad++ 업데이터)가 공급망 침해를 암시하는 의심스러운 자식 프로세스를 생성하는 것을 탐지
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
tags:
    - attack.initial_access
    - attack.t1195.002
    - cve.2025.15556
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\gup.exe'
    filter_legitimate:
        Image|endswith:
            - '\npp.Installer.x64.exe'
            - '\npp.Installer.exe'
    condition: selection_parent and not filter_legitimate
falsepositives:
    - 비표준 이름을 가진 정식 Notepad++ 설치 프로그램
level: high

title: temp.sh를 통한 정찰 데이터 유출
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: 시스템 정찰 후 temp.sh로 데이터를 업로드하는 것을 탐지합니다. Notepad++ 공급망 공격에서 관찰됨
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
tags:
    - attack.exfiltration
    - attack.t1567
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_curl:
        CommandLine|contains:
            - 'temp.sh/upload'
            - 'temp.sh'
        Image|endswith: '\curl.exe'
    condition: selection_curl
falsepositives:
    - temp.sh 파일 공유 서비스의 합법적 사용 (기업 환경에서는 드뭄)
level: high

title: Notepad++ 공급망 C2 도메인 해석
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Notepad++ 공급망 공격과 관련된 C2 도메인의 DNS 해석 탐지
author: Renato Z3r0 ed i miei sorcini
date: 2026/02/09
references:
    - https://securelist.com/notepad-supply-chain-attack/118708/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'cdncheck.it.com'
            - 'safe-dns.it.com'
            - 'self-dns.it.com'
            - 'api.skycloudcenter.com'
            - 'api.wiresguard.com'
    condition: selection
falsepositives:
    - 기업 환경에서는 매우 드묾
level: critical