CL-STA-1062 Fake MicrosoftEdgeUpdate Scheduled Task Pointing to ProgramData

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•10

Detects the creation of scheduled tasks named 'MicrosoftEdgeUpdate' or 'MicrosoftEdge' that execute files located in non-standard directories such as ProgramData or Temp. This is a common technique used by threat actors to achieve persistence while masquerading as legitimate update services.