Suspicious GUP Usage

Title: Suspicious GUP Usage
Status: test
Description:Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks
References:
  -https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html
Author: Florian Roth (Nextron Systems)
Date: 2019-02-06
modified:2022-08-13
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\GUP.exe'
  filter_programfiles:
    Image|endswith:
      -'\Program Files\Notepad++\updater\GUP.exe'
      -'\Program Files (x86)\Notepad++\updater\GUP.exe'

  filter_user:
    Image|contains: '\Users\'
    Image|endswith:
      -'\AppData\Local\Notepad++\updater\GUP.exe'
      -'\AppData\Roaming\Notepad++\updater\GUP.exe'

  condition:selection and not 1 of filter_*
Falsepositives:
  -Execution of tools named GUP.exe and located in folders different than Notepad++\updater
Level: high