Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
1
1
Platforms
2
Products / Services
1
MITRE Techniques
1
1
1
1
1
CVEs
71
71
64
58
49
Detects suspicious modifications to Notepad++ configuration files (config.xml or shortcuts.xml) by processes other than Notepad++ itself. This behavior may indicate an attempt to exploit vulnerabilities (e.g., CVE-2026-48778 or CVE-2026-48800) by injecting unvalidated interpreter commands, leading to arbitrary code execution or other malicious activities.
Detects the execution of Notepad++ using the '-settingsDir=' argument, which can be used to redirect the application to load attacker-controlled configuration files, potentially exploiting vulnerabilities like CVE-2026-48778. This technique could allow an adversary to achieve persistence or execute malicious code by manipulating Notepad++'s configuration.