CVE-2026-77605

Sentinel/Defender KQL

DeviceFileEvents
| where FileName endswith ".cmd"
| where InitiatingProcessFileName == "notepad++.exe"
| join kind=inner (DeviceFileEvents
    | where FileName endswith ".txt"
    | extend BaseFileName = FileName
    | extend CmdFileName = strcat(BaseFileName, ".cmd")
    | project FolderPath, CmdFileName, Timestamp
) on $left.FolderPath == $right.FolderPath and $left.FileName == $right.CmdFileName
| where Timestamp between (ago(1h) .. now())
| project-reorder Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName

Splunk SPL

(index=* OR index=*) sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 Image="*\\notepad++.exe" CommandLine="*.cmd" | join type=inner _time
    [ (index=* OR index=*) sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 TargetFilename="*.txt.cmd" | eval BaseFileName=replace(TargetFilename, ".cmd", "") | eval TxtFileName=BaseFileName | eval CmdFileName=TargetFilename | fields _time, Directory, TxtFileName, CmdFileName ]
    on Directory, CmdFileName
| where _time >= relative_time(now(), "-1h@h")
| table _time, Host, Directory, TxtFileName, CmdFileName, Image, CommandLine

Sigma

title: Notepad++ Run by System Target Confusion
id: 00fa5df0-da1d-4f6b-3343-17aa979db13ac77ee24d
status: experimental
description: Detects Notepad++ executing a .cmd file that shares a base name with a .txt file in the same directory, indicating potential exploitation of CVE-2026-77605.
author: SecBoard
date: 2026/08/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd_creation:
    EventID: 11 # File creation event (Sysmon)
    TargetFilename|endswith: '.cmd'
    TargetFilename|contains: '.txt.cmd'
  selection_npp_execution:
    EventID: 1 # Process creation event (Sysmon)
    Image|endswith: '\notepad++.exe'
    CommandLine|contains: '.cmd'
  condition: selection_cmd_creation and selection_npp_execution
  timeframe: 1h
falsepositives:
  - Legitimate scripts with similar naming conventions (unlikely for .txt.cmd)
level: high

Elastic ES|QL

file where event.type == "creation" and file.extension == "cmd" and file.name : "*.txt.cmd"
| join kind=inner (process where event.type == "start" and process.executable : "*\\notepad++.exe" and process.command_line : "*.cmd")
  on file.directory == process.working_directory and file.name == process.command_line
| where @timestamp >= NOW() - INTERVAL 1 HOUR
| select @timestamp, host.name, file.directory, file.name, process.executable, process.command_line