Arbitrary File Download Via MSEDGE_PROXY.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•13

Detects the usage of "msedge_proxy.exe" to download arbitrary files by looking for its execution with command-line arguments containing 'http://' or 'https://'. This behavior can be abused for defense evasion and execution.