ToastNotify.exe Notification Phishing Dispatch via sendtoast Argument

Bryant Smith@flowstate

•updated Mar 25, 2026•0•50

Detects execution of ToastNotify.exe with the sendtoast subcommand, which dispatches a phishing notification with a title and body text using a specified AUMID for impersonation. Review CommandLine for Windows.Defender.SecurityCenter, MSTeams_8wekyb3d8bbwe, or MSEdge to identify the application being impersonated.