Notepad.exe Executing Markdown from WindowsApps (Excluding Specific Version) - CrowdStrike Version

Lightkun Yagami@lightkun_CrowdStriker

•updated Apr 20, 2026•16•0•476

---credit to @KQLWizard--- This rule is a CrowdStrike translation from KQL based on @KQLWizard's detection rule: https://detections.ai/rules/019c5143-2be7-765f-9d0b-4d41499ff6d6