StegoAd CVE-2026-20245: Edge Extension Privilege Escalation via Crash+Child Spawn

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects suspicious activities involving the Microsoft Edge browser (msedge.exe). It monitors for the spawning of known command-line utilities (e.g., cmd.exe, powershell.exe) by the browser process and the loading of DLLs that do not originate from expected Windows or Microsoft Edge installation directories. Additionally, it correlates these events with recent Microsoft Edge application crashes on the same host, which may indicate exploitation attempts.