Pre-execution EDR/AV process check (CrowdStrike/Sophos) followed by stealthy msedge.exe stealth-flag launch
Detects a sequence where a host performs process enumeration for EDR/AV security tools (CrowdStrike, Sophos) followed within 5 minutes by the execution of Microsoft Edge with specific flags (--headless=new or --no-startup-window, --load-extension, --disable-sync). This pattern is consistent with the UNC6692 'Edgecution' malware tradecraft used to check for security presence before sideloading a malicious browser extension.
Microsoft Sentinel (KQL)
