Password-protected tar.exe extraction from suspicious Edge User Data staging path

Duo Tech@duotech

•updated Aug 5, 2026•2•0•1

Detects the execution of tar.exe with passphrase-protected extraction flags (-xf and --passphrase) originating from or operating within a Microsoft Edge User Data directory. This behavior aligns with the 'Edgecution' malware deployment technique, where attackers leverage Edge application paths for staging and executing malicious payloads, as observed in UNC6692 campaigns.