Tar.exe extraction of embedded Python runtime for Edgecution native host
This rule detects the extraction of a specific Python 3.13.3 embedded runtime archive ('python-3.13.3-embed-amd64-with-pip.zip') using tar.exe with a passphrase, targeted specifically at the Microsoft Edge User Data directory. The execution is flagged when initiated by processes like AutoHotkey or processes originating from within the Edge User Data directory, which is indicative of the 'Edgecution' malware suite's method for establishing a persistent native messaging host to facilitate malicious browser-based activity.
Microsoft Sentinel (KQL)
