Notepad++ Supply Chain Attack - Malicious File Detection

Rudra Verma@Rudraverma

•updated Feb 9, 2026•39•1•234

Detects file operations involving known malicious hashes associated with a Notepad++ supply chain compromise. The rule identifies files with specific SHA1 hashes and provides contextual information such as action type, device name, file path, and initiating process details. The enhanced version further categorizes risk levels, enriches data with Notepad++ specific context, and aggregates events for a summary view, including threat metrics and prioritization for response actions.