Unexpected Notepad++ Updater Registry Modification
This rule detects unexpected modifications to Notepad++ updater settings in the Windows Registry. Specifically, it looks for instances where the 'updater' registry value under 'Notepad++\Settings' is set to '1' or 'true', indicating that automatic updates are enabled or forced. This could be an indicator of compromise if Notepad++ is not expected to update automatically or if the modification occurs outside of normal update cycles, potentially by an attacker attempting to maintain persistence or introduce malicious updates.
Microsoft Sentinel (KQL)
