Notepad.exe Executing Markdown from WindowsApps (Excluding Specific Version)
This rule detects the execution of 'notepad.exe' specifically when it is launched from the WindowsApps directory (excluding version '11.2510') and its command line arguments include the string '.md'. This combination suggests an attempt to open or process Markdown files using a specific, potentially non-standard, version of Notepad. This could indicate unusual user activity, a misconfigured application, or potentially malicious activity involving Markdown files, such as data exfiltration or execution of embedded content.
Microsoft Sentinel (KQL)
