Notepad Exploitation URI Scheme Detection
Identifies command-line arguments that involve both a Markdown (.md) file and a suspicious URI scheme. This could indicate an attempt to exploit CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links.
Microsoft Sentinel (KQL)

