Rogue Edge Native Messaging Host Registration for Extension IPC Persistence
Detects creation of Chromium/Edge NativeMessagingHosts registry keys or supporting files (native_host.py, *.api.json) pointing to non-Program Files locations such as AppData, Temp, or ProgramData, consistent with the Edgecution malicious edge extension backdoor's native messaging host persistence mechanism used by UNC6692 to enable extension-to-native-process IPC.
Microsoft Sentinel (KQL)
