Edgecution native_host.py fingerprinting correlated with msedge lineage
Detects execution of the Edgecution malware suite native messaging host (native_host.py), which fingerprints the host system by reading environment variables (USERNAME, COMPUTERNAME, etc.). The rule correlates this behavior with a specific, suspicious process lineage originating from Microsoft Edge (msedge.exe -> native host -> python.exe).
Microsoft Sentinel (KQL)
