Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
1
1
Contributors
3
2
1
1
1
Categories
5
5
4
2
2
Platforms
8
Products / Services
4
2
MITRE Techniques
5
3
3
2
2
CVEs
71
71
64
58
49
Identifies command-line arguments that involve both a Markdown (.md) file and a suspicious URI scheme. This could indicate an attempt to exploit CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit a vulnerability (e.g., CVE-2026-20841) to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
---credit to @KQLWizard---
This rule is a CrowdStrike translation from KQL based on @KQLWizard's detection rule: https://detections.ai/rules/019c5143-2be7-765f-9d0b-4d41499ff6d6
This rule is a CrowdStrike translation from KQL based on @KQLWizard's detection rule: https://detections.ai/rules/019c5143-2be7-765f-9d0b-4d41499ff6d6
This rule detects the execution of 'notepad.exe' specifically when it is launched from the WindowsApps directory (excluding version '11.2510') and its command line arguments include the string '.md'. This combination suggests an attempt to open or process Markdown files using a specific, potentially non-standard, version of Notepad. This could indicate unusual user activity, a misconfigured application, or potentially malicious activity involving Markdown files, such as data exfiltration or execution of embedded content.
This rule identifies command-line arguments that contain both a Markdown (.md) file extension and a suspicious URI scheme. This pattern is indicative of an attempt to exploit vulnerabilities, such as CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links or actions through specific URI handlers.
CrowdStrike Query – Potential Notepad Abuse via WindowsApps
Detects execution of notepad.exe from the Windows Apps directory (excluding version 11.2510) with command-line arguments containing “.md”. This behavior may indicate invocation of a non-standard Notepad build for Markdown file handling, potentially linked to application misconfiguration or malicious activity.
Detects execution of notepad.exe from the Windows Apps directory (excluding version 11.2510) with command-line arguments containing “.md”. This behavior may indicate invocation of a non-standard Notepad build for Markdown file handling, potentially linked to application misconfiguration or malicious activity.
Detects instances where the Windows 11 Notepad process (Notepad.exe) spawns unexpected child processes. This behavior is a primary indicator of the CVE-2026-20841 exploitation via malicious Markdown links, which allows for remote code execution.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit CVE-2026-20841 to trigger an NTLM relay attack for credential harvesting or to download a remote payload.