Edgecution AutoHotkey stager execution (set36418917.ahk/.exe) from unusual path

Duo Tech@duotech

•updated Aug 5, 2026•1•0•0

Detects the execution of AutoHotkey-based Edgecution malware stagers (set36418917.ahk/.exe) and their associated file-drop events in unusual locations like user temp and downloads folders. This activity is associated with the threat actor UNC6692 following hands-on-keyboard access via Quick Assist.