• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Malicious Edge Extension Installer Executed via Microsoft Teams Chat

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Georgios Maragos@Gmarak
    •updated Jun 26, 2026•2•0•23

    Detects the execution of .crx Edge extension files where the parent process is Microsoft Teams, often indicating social engineering attacks delivering malicious extensions.

    Sigma

    Tags

    T1204.002 - Malicious FileT1566.004 - Spearphishing VoiceTA0002 - ExecutionTA0001 - Initial AccessProcess CreationWindowsWindows SysmonWindows Eventlog Securityattack.t1566.004attack.t1204.002attack.t1598

    Found in

    • UNC6692 Phishing Campaign Deploying Custom Edgecution Malware SuiteLast updated Aug 5, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?