Vulnerable Notepad++ Version Detected
This rule identifies devices running vulnerable versions of Notepad++. It parses the software version to determine if it is older than 8.9.1, which was identified as vulnerable in a security incident. The rule specifically looks for Notepad++ installations and flags any instances where the major version is less than 8, or if the major version is 8 and the minor version is less than 9, or if the major version is 8, the minor version is 9, and the patch version is less than 1.
Microsoft Sentinel (KQL)
