SNOWBELT - Headless Edge Loader Extension Launch (T1176)
Identifies command prompts spawning headless Microsoft Edge with user data directories redirected and forced extension loading. This behavior is often associated with malware attempting to load malicious browser extensions or exfiltrate data without a visible browser window.
Microsoft Sentinel (KQL)
