ToastNotify.exe Phishing Tool Process Execution

Bryant Smith@flowstate

•updated Mar 25, 2026•0•38

Detects any execution of ToastNotify.exe, the .NET assembly used to dispatch phishing toast notifications impersonating legitimate applications. This catch-all rule fires when the binary runs with an unrecognized or absent subcommand. In environments that support rule ordering, evaluate subcommand-specific rules (getaumid, sendtoast, custom) before this rule. ToastNotify.exe has no known legitimate enterprise use.