Python native-host process spawning shell/PowerShell via Edgecution lineage

Duo Tech@duotech

•updated Aug 5, 2026•1•0•2

Detects a Python process invoking native_host.py (the Edgecution native messaging host component) spawning cmd.exe or powershell.exe with command-line flags consistent with UNC6692's Edgecution malware suite execution capability, including PowerShell launched with -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command or cmd.exe launched with /c chcp 65001.