SNOWBELT Headless Edge Extension Load
Detects Microsoft Edge launching in headless mode and loading an unpacked extension. This technique is utilized by UNC6692 to maintain persistence and execute the SNOWBELT malicious browser extension without user visibility.
Sigma
