Edgecution SNOWBELT malicious msedge.exe sideload via combined --load-extension flags
Detects the execution of Microsoft Edge (msedge.exe) with suspicious command-line arguments designed to sideload malicious browser extensions, often associated with the UNC6692 campaign. The rule specifically looks for a combination of flags including --load-extension, headless/no-startup-window modes, known malicious or suspicious paths (e.g., 'User Data\test1'), and the disabling of browser synchronization or the first-run experience, occasionally triggered by scheduled tasks.
Microsoft Sentinel (KQL)
