Notepad Exploitation via URI Scheme and Markdown File

Ethan Andrews@eandrews

•updated Feb 13, 2026•22•0•139

This rule identifies command-line arguments that contain both a Markdown (.md) file extension and a suspicious URI scheme. This pattern is indicative of an attempt to exploit vulnerabilities, such as CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links or actions through specific URI handlers.