Malicious Edge Update Scheduled Task with PowerShell Download Cradle
Detects the creation of a scheduled task named 'MicrosoftEdgeUpdate' that leverages PowerShell to download and execute a payload. This technique was observed in an Iranian-Nexus operation against Oman's government.
Microsoft Sentinel (KQL)
