List out Internet facing Devices with Vulnerable Notepad ++ Supply Chain Attack
This rule identifies internet-facing devices that have Notepad++ installed with versions outside of a specified approved list. It correlates software inventory with device exposure data to highlight externally exposed systems, summarizes the affected Notepad++ versions per device, and prioritizes results based on exposure level for risk-based remediation.
Microsoft Sentinel (KQL)
