SNOWBELT - CoreUIComponents Evasion Check Task (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•1

Captures the scheduled cleanup task executed via cmd to terminate headless Edge instances lacking CoreUIComponents.dll. This activity is associated with the SNOWBELT threat actor group, specifically targeting defense evasion by checking for the presence of a specific DLL.