Notepad++ Explorer Binary Planting (CVE-2026-25926)
Detects the execution of 'explorer.exe' from outside the standard C:\Windows\ directory when launched by Notepad++, indicating potential exploitation of the CVE-2026-25926 unsafe search path vulnerability.
Microsoft Sentinel (KQL)

