All Detections

Multi-Stage Notepad++ hunting Activity

avatar
Daniel Jeremiah@daniyyell
updated Feb 3, 2026612562

Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.

Microsoft Sentinel (KQL)